* [OE-core][kirkstone 00/14] Patch review
@ 2023-03-23 21:04 Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 01/14] curl: Add fix for CVE-2023-23914, CVE-2023-23915 Steve Sakoman
` (13 more replies)
0 siblings, 14 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-03-23 21:04 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for kirkstone and have comments back by
end of day Monday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/5087
The following changes since commit 7df46e003ea76cf7d5b7263f23bd6e6a781bd22c:
base-files: Drop localhost.localdomain from hosts file (2023-03-17 04:52:21 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Alexander Kanavin (1):
devtool/upgrade: do not delete the workspace/recipes directory
Chee Yang Lee (1):
git: ignore CVE-2023-22743
Khem Raj (1):
systemd.bbclass: Add /usr/lib/systemd to searchpaths as well
Martin Jansa (3):
timezone: use 'tz' subdir instead of ${WORKDIR} directly
tzdata: use separate B instead of WORKDIR for zic output
tzcode-native: fix build with gcc-13 on host
Mikko Rapeli (1):
oeqa rtc.py: skip if read-only-rootfs
Pawan Badganchi (1):
curl: Add fix for CVE-2023-23914, CVE-2023-23915
Peter Marko (1):
systemd: fix CVE-2022-4415
Piotr Łobacz (1):
systemd: fix wrong nobody-group assignment
Richard Purdie (1):
pybootchartui: Fix python syntax issue
Romuald Jeanne (1):
image_types: fix multiubi var init
Ross Burton (1):
lib/resulttool: fix typo breaking resulttool log --ptest
Tim Orling (1):
cracklib: update github branch to 'main'
meta/classes/image_types.bbclass | 3 +
meta/classes/systemd.bbclass | 1 +
meta/lib/oeqa/runtime/cases/rtc.py | 8 +-
.../systemd/systemd/CVE-2022-4415-1.patch | 109 +++++
.../systemd/systemd/CVE-2022-4415-2.patch | 391 ++++++++++++++++++
meta/recipes-core/systemd/systemd_250.5.bb | 4 +-
meta/recipes-devtools/git/git_2.35.7.bb | 2 +
.../cracklib/cracklib_2.9.8.bb | 2 +-
meta/recipes-extended/timezone/timezone.inc | 6 +-
.../timezone/tzcode-native.bb | 3 +-
...0001-Fix-C23-related-conformance-bug.patch | 301 ++++++++++++++
meta/recipes-extended/timezone/tzdata.bb | 16 +-
.../curl/curl/CVE-2023-23914_5-1.patch | 280 +++++++++++++
.../curl/curl/CVE-2023-23914_5-2.patch | 23 ++
.../curl/curl/CVE-2023-23914_5-3.patch | 45 ++
.../curl/curl/CVE-2023-23914_5-4.patch | 48 +++
.../curl/curl/CVE-2023-23914_5-5.patch | 118 ++++++
meta/recipes-support/curl/curl_7.82.0.bb | 5 +
scripts/lib/devtool/upgrade.py | 3 -
scripts/lib/resulttool/resultutils.py | 2 +-
.../pybootchartgui/pybootchartgui/parsing.py | 2 +-
21 files changed, 1351 insertions(+), 21 deletions(-)
create mode 100644 meta/recipes-core/systemd/systemd/CVE-2022-4415-1.patch
create mode 100644 meta/recipes-core/systemd/systemd/CVE-2022-4415-2.patch
create mode 100644 meta/recipes-extended/timezone/tzcode/0001-Fix-C23-related-conformance-bug.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2023-23914_5-1.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2023-23914_5-2.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2023-23914_5-3.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2023-23914_5-4.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2023-23914_5-5.patch
--
2.34.1
^ permalink raw reply [flat|nested] 20+ messages in thread
* [OE-core][kirkstone 01/14] curl: Add fix for CVE-2023-23914, CVE-2023-23915
2023-03-23 21:04 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
@ 2023-03-23 21:04 ` Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 02/14] systemd: fix CVE-2022-4415 Steve Sakoman
` (12 subsequent siblings)
13 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-03-23 21:04 UTC (permalink / raw)
To: openembedded-core
From: Pawan Badganchi <badganchipv@gmail.com>
Add below patches to fix CVE-2023-23914 [1], CVE-2023-23915 [2]
CVE-2023-23914_5-1.patch
CVE-2023-23914_5-2.patch
CVE-2023-23914_5-3.patch
CVE-2023-23914_5-4.patch
CVE-2023-23914_5-5.patch
[1] https://curl.se/docs/CVE-2023-23914.html
[2] https://curl.se/docs/CVE-2023-23915.html
Signed-off-by: Pawan Badganchi <Pawan.Badganchi@kpit.com>
Signed-off-by: pawan <badganchipv@gmail.com>
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../curl/curl/CVE-2023-23914_5-1.patch | 280 ++++++++++++++++++
.../curl/curl/CVE-2023-23914_5-2.patch | 23 ++
.../curl/curl/CVE-2023-23914_5-3.patch | 45 +++
.../curl/curl/CVE-2023-23914_5-4.patch | 48 +++
.../curl/curl/CVE-2023-23914_5-5.patch | 118 ++++++++
meta/recipes-support/curl/curl_7.82.0.bb | 5 +
6 files changed, 519 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2023-23914_5-1.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2023-23914_5-2.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2023-23914_5-3.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2023-23914_5-4.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2023-23914_5-5.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2023-23914_5-1.patch b/meta/recipes-support/curl/curl/CVE-2023-23914_5-1.patch
new file mode 100644
index 0000000000..d357cee76c
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2023-23914_5-1.patch
@@ -0,0 +1,280 @@
+From 076a2f629119222aeeb50f5a03bf9f9052fabb9a Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Tue, 27 Dec 2022 11:50:20 +0100
+Subject: [PATCH] share: add sharing of HSTS cache among handles
+
+Closes #10138
+
+CVE: CVE-2023-23914 CVE-2023-23915
+Upstream-Status: Backport [https://github.com/curl/curl/commit/076a2f629119222aeeb50f5a03bf9f9052fabb9a]
+Comment: Refreshed hunk from hsts.c and urldata.h
+Signed-off-by: Pawan Badganchi <Pawan.Badganchi@kpit.com>
+Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
+---
+ include/curl/curl.h | 1 +
+ lib/hsts.c | 15 +++++++++
+ lib/hsts.h | 2 ++
+ lib/setopt.c | 48 ++++++++++++++++++++++++-----
+ lib/share.c | 32 +++++++++++++++++--
+ lib/share.h | 6 +++-
+ lib/transfer.c | 3 ++
+ lib/url.c | 6 +++-
+ lib/urldata.h | 2 ++
+ 9 files changed, 109 insertions(+), 11 deletions(-)
+
+--- a/include/curl/curl.h
++++ b/include/curl/curl.h
+@@ -2953,6 +2953,7 @@ typedef enum {
+ CURL_LOCK_DATA_SSL_SESSION,
+ CURL_LOCK_DATA_CONNECT,
+ CURL_LOCK_DATA_PSL,
++ CURL_LOCK_DATA_HSTS,
+ CURL_LOCK_DATA_LAST
+ } curl_lock_data;
+
+--- a/lib/hsts.c
++++ b/lib/hsts.c
+@@ -37,6 +37,7 @@
+ #include "parsedate.h"
+ #include "rand.h"
+ #include "rename.h"
++#include "share.h"
+ #include "strtoofft.h"
+
+ /* The last 3 #include files should be in this order */
+@@ -561,4 +562,18 @@
+ return CURLE_OK;
+ }
+
++void Curl_hsts_loadfiles(struct Curl_easy *data)
++{
++ struct curl_slist *l = data->set.hstslist;
++ if(l) {
++ Curl_share_lock(data, CURL_LOCK_DATA_HSTS, CURL_LOCK_ACCESS_SINGLE);
++
++ while(l) {
++ (void)Curl_hsts_loadfile(data, data->hsts, l->data);
++ l = l->next;
++ }
++ Curl_share_unlock(data, CURL_LOCK_DATA_HSTS);
++ }
++}
++
+ #endif /* CURL_DISABLE_HTTP || CURL_DISABLE_HSTS */
+--- a/lib/hsts.h
++++ b/lib/hsts.h
+@@ -59,9 +59,11 @@ CURLcode Curl_hsts_loadfile(struct Curl_
+ struct hsts *h, const char *file);
+ CURLcode Curl_hsts_loadcb(struct Curl_easy *data,
+ struct hsts *h);
++void Curl_hsts_loadfiles(struct Curl_easy *data);
+ #else
+ #define Curl_hsts_cleanup(x)
+ #define Curl_hsts_loadcb(x,y) CURLE_OK
+ #define Curl_hsts_save(x,y,z)
++#define Curl_hsts_loadfiles(x)
+ #endif /* CURL_DISABLE_HTTP || CURL_DISABLE_HSTS */
+ #endif /* HEADER_CURL_HSTS_H */
+--- a/lib/setopt.c
++++ b/lib/setopt.c
+@@ -2260,9 +2260,14 @@ CURLcode Curl_vsetopt(struct Curl_easy *
+ data->cookies = NULL;
+ #endif
+
++#ifndef CURL_DISABLE_HSTS
++ if(data->share->hsts == data->hsts)
++ data->hsts = NULL;
++#endif
++#ifdef USE_SSL
+ if(data->share->sslsession == data->state.session)
+ data->state.session = NULL;
+-
++#endif
+ #ifdef USE_LIBPSL
+ if(data->psl == &data->share->psl)
+ data->psl = data->multi? &data->multi->psl: NULL;
+@@ -2296,10 +2301,19 @@ CURLcode Curl_vsetopt(struct Curl_easy *
+ data->cookies = data->share->cookies;
+ }
+ #endif /* CURL_DISABLE_HTTP */
++#ifndef CURL_DISABLE_HSTS
++ if(data->share->hsts) {
++ /* first free the private one if any */
++ Curl_hsts_cleanup(&data->hsts);
++ data->hsts = data->share->hsts;
++ }
++#endif /* CURL_DISABLE_HTTP */
++#ifdef USE_SSL
+ if(data->share->sslsession) {
+ data->set.general_ssl.max_ssl_sessions = data->share->max_ssl_sessions;
+ data->state.session = data->share->sslsession;
+ }
++#endif
+ #ifdef USE_LIBPSL
+ if(data->share->specifier & (1 << CURL_LOCK_DATA_PSL))
+ data->psl = &data->share->psl;
+@@ -3049,19 +3063,39 @@ CURLcode Curl_vsetopt(struct Curl_easy *
+ case CURLOPT_HSTSWRITEDATA:
+ data->set.hsts_write_userp = va_arg(param, void *);
+ break;
+- case CURLOPT_HSTS:
++ case CURLOPT_HSTS: {
++ struct curl_slist *h;
+ if(!data->hsts) {
+ data->hsts = Curl_hsts_init();
+ if(!data->hsts)
+ return CURLE_OUT_OF_MEMORY;
+ }
+ argptr = va_arg(param, char *);
+- result = Curl_setstropt(&data->set.str[STRING_HSTS], argptr);
+- if(result)
+- return result;
+- if(argptr)
+- (void)Curl_hsts_loadfile(data, data->hsts, argptr);
++ if(argptr) {
++ result = Curl_setstropt(&data->set.str[STRING_HSTS], argptr);
++ if(result)
++ return result;
++ /* this needs to build a list of file names to read from, so that it can
++ read them later, as we might get a shared HSTS handle to load them
++ into */
++ h = curl_slist_append(data->set.hstslist, argptr);
++ if(!h) {
++ curl_slist_free_all(data->set.hstslist);
++ data->set.hstslist = NULL;
++ return CURLE_OUT_OF_MEMORY;
++ }
++ data->set.hstslist = h; /* store the list for later use */
++ }
++ else {
++ /* clear the list of HSTS files */
++ curl_slist_free_all(data->set.hstslist);
++ data->set.hstslist = NULL;
++ if(!data->share || !data->share->hsts)
++ /* throw away the HSTS cache unless shared */
++ Curl_hsts_cleanup(&data->hsts);
++ }
+ break;
++ }
+ case CURLOPT_HSTS_CTRL:
+ arg = va_arg(param, long);
+ if(arg & CURLHSTS_ENABLE) {
+--- a/lib/share.c
++++ b/lib/share.c
+@@ -29,9 +29,11 @@
+ #include "share.h"
+ #include "psl.h"
+ #include "vtls/vtls.h"
+-#include "curl_memory.h"
++#include "hsts.h"
+
+-/* The last #include file should be: */
++/* The last 3 #include files should be in this order */
++#include "curl_printf.h"
++#include "curl_memory.h"
+ #include "memdebug.h"
+
+ struct Curl_share *
+@@ -89,6 +91,18 @@ curl_share_setopt(struct Curl_share *sha
+ #endif
+ break;
+
++ case CURL_LOCK_DATA_HSTS:
++#ifndef CURL_DISABLE_HSTS
++ if(!share->hsts) {
++ share->hsts = Curl_hsts_init();
++ if(!share->hsts)
++ res = CURLSHE_NOMEM;
++ }
++#else /* CURL_DISABLE_HSTS */
++ res = CURLSHE_NOT_BUILT_IN;
++#endif
++ break;
++
+ case CURL_LOCK_DATA_SSL_SESSION:
+ #ifdef USE_SSL
+ if(!share->sslsession) {
+@@ -141,6 +155,16 @@ curl_share_setopt(struct Curl_share *sha
+ #endif
+ break;
+
++ case CURL_LOCK_DATA_HSTS:
++#ifndef CURL_DISABLE_HSTS
++ if(share->hsts) {
++ Curl_hsts_cleanup(&share->hsts);
++ }
++#else /* CURL_DISABLE_HSTS */
++ res = CURLSHE_NOT_BUILT_IN;
++#endif
++ break;
++
+ case CURL_LOCK_DATA_SSL_SESSION:
+ #ifdef USE_SSL
+ Curl_safefree(share->sslsession);
+@@ -207,6 +231,10 @@ curl_share_cleanup(struct Curl_share *sh
+ Curl_cookie_cleanup(share->cookies);
+ #endif
+
++#ifndef CURL_DISABLE_HSTS
++ Curl_hsts_cleanup(&share->hsts);
++#endif
++
+ #ifdef USE_SSL
+ if(share->sslsession) {
+ size_t i;
+--- a/lib/share.h
++++ b/lib/share.h
+@@ -59,10 +59,14 @@ struct Curl_share {
+ #ifdef USE_LIBPSL
+ struct PslCache psl;
+ #endif
+-
++#ifndef CURL_DISABLE_HSTS
++ struct hsts *hsts;
++#endif
++#ifdef USE_SSL
+ struct Curl_ssl_session *sslsession;
+ size_t max_ssl_sessions;
+ long sessionage;
++#endif
+ };
+
+ CURLSHcode Curl_share_lock(struct Curl_easy *, curl_lock_data,
+--- a/lib/transfer.c
++++ b/lib/transfer.c
+@@ -1398,6 +1398,9 @@ CURLcode Curl_pretransfer(struct Curl_ea
+ if(data->state.resolve)
+ result = Curl_loadhostpairs(data);
+
++ /* If there is a list of hsts files to read */
++ Curl_hsts_loadfiles(data);
++
+ if(!result) {
+ /* Allow data->set.use_port to set which port to use. This needs to be
+ * disabled for example when we follow Location: headers to URLs using
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -434,7 +434,11 @@ CURLcode Curl_close(struct Curl_easy **d
+ Curl_altsvc_save(data, data->asi, data->set.str[STRING_ALTSVC]);
+ Curl_altsvc_cleanup(&data->asi);
+ Curl_hsts_save(data, data->hsts, data->set.str[STRING_HSTS]);
+- Curl_hsts_cleanup(&data->hsts);
++#ifndef CURL_DISABLE_HSTS
++ if(!data->share || !data->share->hsts)
++ Curl_hsts_cleanup(&data->hsts);
++ curl_slist_free_all(data->set.hstslist); /* clean up list */
++#endif
+ #if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_CRYPTO_AUTH)
+ Curl_http_auth_cleanup_digest(data);
+ #endif
+--- a/lib/urldata.h
++++ b/lib/urldata.h
+@@ -1670,6 +1670,8 @@
+
+ void *seek_client; /* pointer to pass to the seek callback */
+ #ifndef CURL_DISABLE_HSTS
++ struct curl_slist *hstslist; /* list of HSTS files set by
++ curl_easy_setopt(HSTS) calls */
+ curl_hstsread_callback hsts_read;
+ void *hsts_read_userp;
+ curl_hstswrite_callback hsts_write;
diff --git a/meta/recipes-support/curl/curl/CVE-2023-23914_5-2.patch b/meta/recipes-support/curl/curl/CVE-2023-23914_5-2.patch
new file mode 100644
index 0000000000..668972cb3f
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2023-23914_5-2.patch
@@ -0,0 +1,23 @@
+From 0bf8b796a0ea98395b390c7807187982215f5c11 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Tue, 27 Dec 2022 11:50:23 +0100
+Subject: [PATCH] tool_operate: share HSTS between handles
+
+CVE: CVE-2023-23914 CVE-2023-23915
+Upstream-Status: Backport [https://github.com/curl/curl/pull/10138/commits/ca17cfed2df001356cfe2841f166569bac0f5e8c]
+Signed-off-by: Pawan Badganchi <Pawan.Badganchi@kpit.com>
+Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
+---
+ src/tool_operate.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/src/tool_operate.c
++++ b/src/tool_operate.c
+@@ -2722,6 +2722,7 @@ CURLcode operate(struct GlobalConfig *gl
+ curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_SSL_SESSION);
+ curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_CONNECT);
+ curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_PSL);
++ curl_share_setopt(share, CURLSHOPT_SHARE, CURL_LOCK_DATA_HSTS);
+
+ /* Get the required arguments for each operation */
+ do {
diff --git a/meta/recipes-support/curl/curl/CVE-2023-23914_5-3.patch b/meta/recipes-support/curl/curl/CVE-2023-23914_5-3.patch
new file mode 100644
index 0000000000..4422b26834
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2023-23914_5-3.patch
@@ -0,0 +1,45 @@
+From ca02a77f05bd5cef20618c8f741aa48b7be0a648 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Tue, 27 Dec 2022 11:50:23 +0100
+Subject: [PATCH] hsts: handle adding the same host name again
+
+It will then use the largest expire time of the two entries.
+
+CVE: CVE-2023-23914 CVE-2023-23915
+Upstream-Status: Backport [https://github.com/curl/curl/pull/10138/commits/e077b30a42272d964d76e5b815a0af7dc65d8360]
+Signed-off-by: Pawan Badganchi <Pawan.Badganchi@kpit.com>
+Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
+---
+ lib/hsts.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/lib/hsts.c b/lib/hsts.c
+index 339237be1c621..8d6723ee587d2 100644
+--- a/lib/hsts.c
++++ b/lib/hsts.c
+@@ -426,14 +426,23 @@ static CURLcode hsts_add(struct hsts *h, char *line)
+ if(2 == rc) {
+ time_t expires = strcmp(date, UNLIMITED) ? Curl_getdate_capped(date) :
+ TIME_T_MAX;
+- CURLcode result;
++ CURLcode result = CURLE_OK;
+ char *p = host;
+ bool subdomain = FALSE;
++ struct stsentry *e;
+ if(p[0] == '.') {
+ p++;
+ subdomain = TRUE;
+ }
+- result = hsts_create(h, p, subdomain, expires);
++ /* only add it if not already present */
++ e = Curl_hsts(h, p, subdomain);
++ if(!e)
++ result = hsts_create(h, p, subdomain, expires);
++ else {
++ /* the same host name, use the largest expire time */
++ if(expires > e->expires)
++ e->expires = expires;
++ }
+ if(result)
+ return result;
+ }
diff --git a/meta/recipes-support/curl/curl/CVE-2023-23914_5-4.patch b/meta/recipes-support/curl/curl/CVE-2023-23914_5-4.patch
new file mode 100644
index 0000000000..865b3f93a5
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2023-23914_5-4.patch
@@ -0,0 +1,48 @@
+From dc0725244a3163f1e2d5f51165db3a1a430f3ba0 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Tue, 27 Dec 2022 11:50:23 +0100
+Subject: [PATCH] runtests: support crlf="yes" for verify/proxy
+
+CVE: CVE-2023-23914 CVE-2023-23915
+Upstream-Status: Backport [https://github.com/curl/curl/pull/10138/commits/fd7e1a557e414dd803c9225e37a2ca84e1df2269]
+Comment: Refreshed hunk from FILEFORMAT.md
+Signed-off-by: Pawan Badganchi <Pawan.Badganchi@kpit.com>
+Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
+---
+ tests/FILEFORMAT.md | 4 ++--
+ tests/runtests.pl | 5 +++++
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+--- a/tests/FILEFORMAT.md
++++ b/tests/FILEFORMAT.md
+@@ -540,14 +540,14 @@
+ One perl op per line that operates on the protocol dump. This is pretty
+ advanced. Example: `s/^EPRT .*/EPRT stripped/`.
+
+-### `<protocol [nonewline="yes"]>`
++### `<protocol [nonewline="yes"][crlf="yes"]>`
+
+ the protocol dump curl should transmit, if 'nonewline' is set, we will cut off
+ the trailing newline of this given data before comparing with the one actually
+ sent by the client The `<strip>` and `<strippart>` rules are applied before
+ comparisons are made.
+
+-### `<proxy [nonewline="yes"]>`
++### `<proxy [nonewline="yes"][crlf="yes"]>`
+
+ The protocol dump curl should transmit to a HTTP proxy (when the http-proxy
+ server is used), if 'nonewline' is set, we will cut off the trailing newline
+--- a/tests/runtests.pl
++++ b/tests/runtests.pl
+@@ -4744,6 +4744,11 @@ sub singletest {
+ }
+ }
+
++ if($hash{'crlf'} ||
++ ($has_hyper && ($keywords{"HTTP"} || $keywords{"HTTPS"}))) {
++ map subNewlines(0, \$_), @protstrip;
++ }
++
+ $res = compare($testnum, $testname, "proxy", \@out, \@protstrip);
+ if($res) {
+ return $errorreturncode;
diff --git a/meta/recipes-support/curl/curl/CVE-2023-23914_5-5.patch b/meta/recipes-support/curl/curl/CVE-2023-23914_5-5.patch
new file mode 100644
index 0000000000..1a363f0b4b
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2023-23914_5-5.patch
@@ -0,0 +1,118 @@
+From ea5aaaa5ede53819f8bc7ae767fc2d13d3704d37 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Tue, 27 Dec 2022 11:50:23 +0100
+Subject: [PATCH] test446: verify hsts with two URLs
+
+CVE: CVE-2023-23914 CVE-2023-23915
+Upstream-Status: Backport [https://github.com/curl/curl/pull/10138/commits/7e89dfd463597701dd1defcad7be54f7d3c9d55d]
+Comment: Refreshed hunk from Makefile.inc
+Signed-off-by: Pawan Badganchi <Pawan.Badganchi@kpit.com>
+Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
+---
+ tests/data/Makefile.inc | 2 +-
+ tests/data/test446 | 84 +++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 85 insertions(+), 1 deletion(-)
+ create mode 100644 tests/data/test446
+
+diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
+index 3a6356bd122bc..fe1bb1c74c2ab 100644
+--- a/tests/data/Makefile.inc
++++ b/tests/data/Makefile.inc
+@@ -72,6 +72,7 @@
+ \
+ test430 test431 test432 test433 test434 test435 test436 \
+ \
++test446 \
+ test490 test491 test492 test493 test494 \
+ \
+ test500 test501 test502 test503 test504 test505 test506 test507 test508 \
+diff --git a/tests/data/test446 b/tests/data/test446
+new file mode 100644
+index 0000000000000..0e2dfdcfe33b6
+--- /dev/null
++++ b/tests/data/test446
+@@ -0,0 +1,84 @@
++<?xml version="1.0" encoding="ISO-8859-1"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP proxy
++HSTS
++trailing-dot
++</keywords>
++</info>
++
++<reply>
++
++# we use this as response to a CONNECT
++<connect nocheck="yes">
++HTTP/1.1 200 OK
++
++</connect>
++<data crlf="yes">
++HTTP/1.1 200 OK
++Content-Length: 6
++Strict-Transport-Security: max-age=604800
++
++-foo-
++</data>
++<data2 crlf="yes">
++HTTP/1.1 200 OK
++Content-Length: 6
++Strict-Transport-Security: max-age=6048000
++
++-baa-
++</data2>
++</reply>
++
++<client>
++<server>
++https
++http-proxy
++</server>
++<features>
++HSTS
++proxy
++https
++debug
++</features>
++<setenv>
++CURL_HSTS_HTTP=yes
++CURL_TIME=2000000000
++</setenv>
++
++<name>
++HSTS with two URLs
++</name>
++<command>
++-x http://%HOSTIP:%PROXYPORT --hsts log/hsts%TESTNUMBER http://this.hsts.example./%TESTNUMBER http://another.example.com/%TESTNUMBER0002
++</command>
++</client>
++
++<verify>
++# we let it CONNECT to the server to confirm HSTS but deny from there
++<proxy crlf="yes">
++GET http://this.hsts.example./%TESTNUMBER HTTP/1.1
++Host: this.hsts.example.
++User-Agent: curl/%VERSION
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++GET http://another.example.com/%TESTNUMBER0002 HTTP/1.1
++Host: another.example.com
++User-Agent: curl/%VERSION
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++</proxy>
++
++<file name="log/hsts%TESTNUMBER" mode="text">
++# Your HSTS cache. https://curl.se/docs/hsts.html
++# This file was generated by libcurl! Edit at your own risk.
++this.hsts.example "20330525 03:33:20"
++another.example.com "20330727 03:33:20"
++</file>
++
++</verify>
++</testcase>
diff --git a/meta/recipes-support/curl/curl_7.82.0.bb b/meta/recipes-support/curl/curl_7.82.0.bb
index b08af29059..b583060889 100644
--- a/meta/recipes-support/curl/curl_7.82.0.bb
+++ b/meta/recipes-support/curl/curl_7.82.0.bb
@@ -34,6 +34,11 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \
file://CVE-2022-42915.patch \
file://CVE-2022-43551.patch \
file://CVE-2022-43552.patch \
+ file://CVE-2023-23914_5-1.patch \
+ file://CVE-2023-23914_5-2.patch \
+ file://CVE-2023-23914_5-3.patch \
+ file://CVE-2023-23914_5-4.patch \
+ file://CVE-2023-23914_5-5.patch \
"
SRC_URI[sha256sum] = "0aaa12d7bd04b0966254f2703ce80dd5c38dbbd76af0297d3d690cdce58a583c"
--
2.34.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [OE-core][kirkstone 02/14] systemd: fix CVE-2022-4415
2023-03-23 21:04 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 01/14] curl: Add fix for CVE-2023-23914, CVE-2023-23915 Steve Sakoman
@ 2023-03-23 21:04 ` Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 03/14] git: ignore CVE-2023-22743 Steve Sakoman
` (11 subsequent siblings)
13 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-03-23 21:04 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Backport from v250-stable branch (v250.9)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../systemd/systemd/CVE-2022-4415-1.patch | 109 +++++
.../systemd/systemd/CVE-2022-4415-2.patch | 391 ++++++++++++++++++
meta/recipes-core/systemd/systemd_250.5.bb | 2 +
3 files changed, 502 insertions(+)
create mode 100644 meta/recipes-core/systemd/systemd/CVE-2022-4415-1.patch
create mode 100644 meta/recipes-core/systemd/systemd/CVE-2022-4415-2.patch
diff --git a/meta/recipes-core/systemd/systemd/CVE-2022-4415-1.patch b/meta/recipes-core/systemd/systemd/CVE-2022-4415-1.patch
new file mode 100644
index 0000000000..5cf0fe284e
--- /dev/null
+++ b/meta/recipes-core/systemd/systemd/CVE-2022-4415-1.patch
@@ -0,0 +1,109 @@
+From 45d323fc889a55fae400a5b08a56273d5724ef4a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
+Date: Tue, 29 Nov 2022 09:00:16 +0100
+Subject: [PATCH 1/2] coredump: adjust whitespace
+
+(cherry picked from commit 510a146634f3e095b34e2a26023b1b1f99dcb8c0)
+(cherry picked from commit cc2eb7a9b5fd6d9dd8ea35fb045ce6e5e16e1187)
+(cherry picked from commit cb044d734c44cd3c05a6e438b5b995b2a9cfa73c)
+
+Preparation to avoid conflicts when applying CVE CVE-2022-4415
+Upstream-Status: Backport [https://github.com/systemd/systemd-stable/commit/45d323fc889a55fae400a5b08a56273d5724ef4a]
+
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ src/coredump/coredump.c | 56 ++++++++++++++++++++---------------------
+ 1 file changed, 28 insertions(+), 28 deletions(-)
+
+diff --git a/src/coredump/coredump.c b/src/coredump/coredump.c
+index eaea63f682..8295b03ac7 100644
+--- a/src/coredump/coredump.c
++++ b/src/coredump/coredump.c
+@@ -103,16 +103,16 @@ enum {
+ };
+
+ static const char * const meta_field_names[_META_MAX] = {
+- [META_ARGV_PID] = "COREDUMP_PID=",
+- [META_ARGV_UID] = "COREDUMP_UID=",
+- [META_ARGV_GID] = "COREDUMP_GID=",
+- [META_ARGV_SIGNAL] = "COREDUMP_SIGNAL=",
+- [META_ARGV_TIMESTAMP] = "COREDUMP_TIMESTAMP=",
+- [META_ARGV_RLIMIT] = "COREDUMP_RLIMIT=",
+- [META_ARGV_HOSTNAME] = "COREDUMP_HOSTNAME=",
+- [META_COMM] = "COREDUMP_COMM=",
+- [META_EXE] = "COREDUMP_EXE=",
+- [META_UNIT] = "COREDUMP_UNIT=",
++ [META_ARGV_PID] = "COREDUMP_PID=",
++ [META_ARGV_UID] = "COREDUMP_UID=",
++ [META_ARGV_GID] = "COREDUMP_GID=",
++ [META_ARGV_SIGNAL] = "COREDUMP_SIGNAL=",
++ [META_ARGV_TIMESTAMP] = "COREDUMP_TIMESTAMP=",
++ [META_ARGV_RLIMIT] = "COREDUMP_RLIMIT=",
++ [META_ARGV_HOSTNAME] = "COREDUMP_HOSTNAME=",
++ [META_COMM] = "COREDUMP_COMM=",
++ [META_EXE] = "COREDUMP_EXE=",
++ [META_UNIT] = "COREDUMP_UNIT=",
+ };
+
+ typedef struct Context {
+@@ -131,9 +131,9 @@ typedef enum CoredumpStorage {
+ } CoredumpStorage;
+
+ static const char* const coredump_storage_table[_COREDUMP_STORAGE_MAX] = {
+- [COREDUMP_STORAGE_NONE] = "none",
++ [COREDUMP_STORAGE_NONE] = "none",
+ [COREDUMP_STORAGE_EXTERNAL] = "external",
+- [COREDUMP_STORAGE_JOURNAL] = "journal",
++ [COREDUMP_STORAGE_JOURNAL] = "journal",
+ };
+
+ DEFINE_PRIVATE_STRING_TABLE_LOOKUP(coredump_storage, CoredumpStorage);
+@@ -149,13 +149,13 @@ static uint64_t arg_max_use = UINT64_MAX;
+
+ static int parse_config(void) {
+ static const ConfigTableItem items[] = {
+- { "Coredump", "Storage", config_parse_coredump_storage, 0, &arg_storage },
+- { "Coredump", "Compress", config_parse_bool, 0, &arg_compress },
+- { "Coredump", "ProcessSizeMax", config_parse_iec_uint64, 0, &arg_process_size_max },
+- { "Coredump", "ExternalSizeMax", config_parse_iec_uint64_infinity, 0, &arg_external_size_max },
+- { "Coredump", "JournalSizeMax", config_parse_iec_size, 0, &arg_journal_size_max },
+- { "Coredump", "KeepFree", config_parse_iec_uint64, 0, &arg_keep_free },
+- { "Coredump", "MaxUse", config_parse_iec_uint64, 0, &arg_max_use },
++ { "Coredump", "Storage", config_parse_coredump_storage, 0, &arg_storage },
++ { "Coredump", "Compress", config_parse_bool, 0, &arg_compress },
++ { "Coredump", "ProcessSizeMax", config_parse_iec_uint64, 0, &arg_process_size_max },
++ { "Coredump", "ExternalSizeMax", config_parse_iec_uint64_infinity, 0, &arg_external_size_max },
++ { "Coredump", "JournalSizeMax", config_parse_iec_size, 0, &arg_journal_size_max },
++ { "Coredump", "KeepFree", config_parse_iec_uint64, 0, &arg_keep_free },
++ { "Coredump", "MaxUse", config_parse_iec_uint64, 0, &arg_max_use },
+ {}
+ };
+
+@@ -201,15 +201,15 @@ static int fix_acl(int fd, uid_t uid) {
+ static int fix_xattr(int fd, const Context *context) {
+
+ static const char * const xattrs[_META_MAX] = {
+- [META_ARGV_PID] = "user.coredump.pid",
+- [META_ARGV_UID] = "user.coredump.uid",
+- [META_ARGV_GID] = "user.coredump.gid",
+- [META_ARGV_SIGNAL] = "user.coredump.signal",
+- [META_ARGV_TIMESTAMP] = "user.coredump.timestamp",
+- [META_ARGV_RLIMIT] = "user.coredump.rlimit",
+- [META_ARGV_HOSTNAME] = "user.coredump.hostname",
+- [META_COMM] = "user.coredump.comm",
+- [META_EXE] = "user.coredump.exe",
++ [META_ARGV_PID] = "user.coredump.pid",
++ [META_ARGV_UID] = "user.coredump.uid",
++ [META_ARGV_GID] = "user.coredump.gid",
++ [META_ARGV_SIGNAL] = "user.coredump.signal",
++ [META_ARGV_TIMESTAMP] = "user.coredump.timestamp",
++ [META_ARGV_RLIMIT] = "user.coredump.rlimit",
++ [META_ARGV_HOSTNAME] = "user.coredump.hostname",
++ [META_COMM] = "user.coredump.comm",
++ [META_EXE] = "user.coredump.exe",
+ };
+
+ int r = 0;
+--
+2.30.2
+
diff --git a/meta/recipes-core/systemd/systemd/CVE-2022-4415-2.patch b/meta/recipes-core/systemd/systemd/CVE-2022-4415-2.patch
new file mode 100644
index 0000000000..8389ee8cd6
--- /dev/null
+++ b/meta/recipes-core/systemd/systemd/CVE-2022-4415-2.patch
@@ -0,0 +1,391 @@
+From 1d5e0e9910500f3c3584485f77bfc35e601036e3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
+Date: Mon, 28 Nov 2022 12:12:55 +0100
+Subject: [PATCH 2/2] coredump: do not allow user to access coredumps with
+ changed uid/gid/capabilities
+
+When the user starts a program which elevates its permissions via setuid,
+setgid, or capabilities set on the file, it may access additional information
+which would then be visible in the coredump. We shouldn't make the the coredump
+visible to the user in such cases.
+
+Reported-by: Matthias Gerstner <mgerstner@suse.de>
+
+This reads the /proc/<pid>/auxv file and attaches it to the process metadata as
+PROC_AUXV. Before the coredump is submitted, it is parsed and if either
+at_secure was set (which the kernel will do for processes that are setuid,
+setgid, or setcap), or if the effective uid/gid don't match uid/gid, the file
+is not made accessible to the user. If we can't access this data, we assume the
+file should not be made accessible either. In principle we could also access
+the auxv data from a note in the core file, but that is much more complex and
+it seems better to use the stand-alone file that is provided by the kernel.
+
+Attaching auxv is both convient for this patch (because this way it's passed
+between the stages along with other fields), but I think it makes sense to save
+it in general.
+
+We use the information early in the core file to figure out if the program was
+32-bit or 64-bit and its endianness. This way we don't need heuristics to guess
+whether the format of the auxv structure. This test might reject some cases on
+fringe architecutes. But the impact would be limited: we just won't grant the
+user permissions to view the coredump file. If people report that we're missing
+some cases, we can always enhance this to support more architectures.
+
+I tested auxv parsing on amd64, 32-bit program on amd64, arm64, arm32, and
+ppc64el, but not the whole coredump handling.
+
+(cherry picked from commit 3e4d0f6cf99f8677edd6a237382a65bfe758de03)
+(cherry picked from commit 9b75a3d0502d6741c8ecb7175794345f8eb3827c)
+(cherry picked from commit efca5283dc791a07171f80eef84e14fdb58fad57)
+
+CVE: CVE-2022-4415
+Upstream-Status: Backport [https://github.com/systemd/systemd-stable/commit/1d5e0e9910500f3c3584485f77bfc35e601036e3]
+
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ src/basic/io-util.h | 9 ++
+ src/coredump/coredump.c | 196 +++++++++++++++++++++++++++++++++++++---
+ 2 files changed, 192 insertions(+), 13 deletions(-)
+
+diff --git a/src/basic/io-util.h b/src/basic/io-util.h
+index 39728e06bc..3afb134266 100644
+--- a/src/basic/io-util.h
++++ b/src/basic/io-util.h
+@@ -91,7 +91,16 @@ struct iovec_wrapper *iovw_new(void);
+ struct iovec_wrapper *iovw_free(struct iovec_wrapper *iovw);
+ struct iovec_wrapper *iovw_free_free(struct iovec_wrapper *iovw);
+ void iovw_free_contents(struct iovec_wrapper *iovw, bool free_vectors);
++
+ int iovw_put(struct iovec_wrapper *iovw, void *data, size_t len);
++static inline int iovw_consume(struct iovec_wrapper *iovw, void *data, size_t len) {
++ /* Move data into iovw or free on error */
++ int r = iovw_put(iovw, data, len);
++ if (r < 0)
++ free(data);
++ return r;
++}
++
+ int iovw_put_string_field(struct iovec_wrapper *iovw, const char *field, const char *value);
+ int iovw_put_string_field_free(struct iovec_wrapper *iovw, const char *field, char *value);
+ void iovw_rebase(struct iovec_wrapper *iovw, char *old, char *new);
+diff --git a/src/coredump/coredump.c b/src/coredump/coredump.c
+index 8295b03ac7..79280ab986 100644
+--- a/src/coredump/coredump.c
++++ b/src/coredump/coredump.c
+@@ -4,6 +4,7 @@
+ #include <stdio.h>
+ #include <sys/prctl.h>
+ #include <sys/statvfs.h>
++#include <sys/auxv.h>
+ #include <sys/xattr.h>
+ #include <unistd.h>
+
+@@ -99,6 +100,7 @@ enum {
+
+ META_EXE = _META_MANDATORY_MAX,
+ META_UNIT,
++ META_PROC_AUXV,
+ _META_MAX
+ };
+
+@@ -113,10 +115,12 @@ static const char * const meta_field_names[_META_MAX] = {
+ [META_COMM] = "COREDUMP_COMM=",
+ [META_EXE] = "COREDUMP_EXE=",
+ [META_UNIT] = "COREDUMP_UNIT=",
++ [META_PROC_AUXV] = "COREDUMP_PROC_AUXV=",
+ };
+
+ typedef struct Context {
+ const char *meta[_META_MAX];
++ size_t meta_size[_META_MAX];
+ pid_t pid;
+ bool is_pid1;
+ bool is_journald;
+@@ -178,13 +182,16 @@ static uint64_t storage_size_max(void) {
+ return 0;
+ }
+
+-static int fix_acl(int fd, uid_t uid) {
++static int fix_acl(int fd, uid_t uid, bool allow_user) {
++ assert(fd >= 0);
++ assert(uid_is_valid(uid));
+
+ #if HAVE_ACL
+ int r;
+
+- assert(fd >= 0);
+- assert(uid_is_valid(uid));
++ /* We don't allow users to read coredumps if the uid or capabilities were changed. */
++ if (!allow_user)
++ return 0;
+
+ if (uid_is_system(uid) || uid_is_dynamic(uid) || uid == UID_NOBODY)
+ return 0;
+@@ -244,7 +251,8 @@ static int fix_permissions(
+ const char *filename,
+ const char *target,
+ const Context *context,
+- uid_t uid) {
++ uid_t uid,
++ bool allow_user) {
+
+ int r;
+
+@@ -254,7 +262,7 @@ static int fix_permissions(
+
+ /* Ignore errors on these */
+ (void) fchmod(fd, 0640);
+- (void) fix_acl(fd, uid);
++ (void) fix_acl(fd, uid, allow_user);
+ (void) fix_xattr(fd, context);
+
+ r = fsync_full(fd);
+@@ -324,6 +332,153 @@ static int make_filename(const Context *context, char **ret) {
+ return 0;
+ }
+
++static int parse_auxv64(
++ const uint64_t *auxv,
++ size_t size_bytes,
++ int *at_secure,
++ uid_t *uid,
++ uid_t *euid,
++ gid_t *gid,
++ gid_t *egid) {
++
++ assert(auxv || size_bytes == 0);
++
++ if (size_bytes % (2 * sizeof(uint64_t)) != 0)
++ return log_warning_errno(SYNTHETIC_ERRNO(EIO), "Incomplete auxv structure (%zu bytes).", size_bytes);
++
++ size_t words = size_bytes / sizeof(uint64_t);
++
++ /* Note that we set output variables even on error. */
++
++ for (size_t i = 0; i + 1 < words; i += 2)
++ switch (auxv[i]) {
++ case AT_SECURE:
++ *at_secure = auxv[i + 1] != 0;
++ break;
++ case AT_UID:
++ *uid = auxv[i + 1];
++ break;
++ case AT_EUID:
++ *euid = auxv[i + 1];
++ break;
++ case AT_GID:
++ *gid = auxv[i + 1];
++ break;
++ case AT_EGID:
++ *egid = auxv[i + 1];
++ break;
++ case AT_NULL:
++ if (auxv[i + 1] != 0)
++ goto error;
++ return 0;
++ }
++ error:
++ return log_warning_errno(SYNTHETIC_ERRNO(ENODATA),
++ "AT_NULL terminator not found, cannot parse auxv structure.");
++}
++
++static int parse_auxv32(
++ const uint32_t *auxv,
++ size_t size_bytes,
++ int *at_secure,
++ uid_t *uid,
++ uid_t *euid,
++ gid_t *gid,
++ gid_t *egid) {
++
++ assert(auxv || size_bytes == 0);
++
++ size_t words = size_bytes / sizeof(uint32_t);
++
++ if (size_bytes % (2 * sizeof(uint32_t)) != 0)
++ return log_warning_errno(SYNTHETIC_ERRNO(EIO), "Incomplete auxv structure (%zu bytes).", size_bytes);
++
++ /* Note that we set output variables even on error. */
++
++ for (size_t i = 0; i + 1 < words; i += 2)
++ switch (auxv[i]) {
++ case AT_SECURE:
++ *at_secure = auxv[i + 1] != 0;
++ break;
++ case AT_UID:
++ *uid = auxv[i + 1];
++ break;
++ case AT_EUID:
++ *euid = auxv[i + 1];
++ break;
++ case AT_GID:
++ *gid = auxv[i + 1];
++ break;
++ case AT_EGID:
++ *egid = auxv[i + 1];
++ break;
++ case AT_NULL:
++ if (auxv[i + 1] != 0)
++ goto error;
++ return 0;
++ }
++ error:
++ return log_warning_errno(SYNTHETIC_ERRNO(ENODATA),
++ "AT_NULL terminator not found, cannot parse auxv structure.");
++}
++
++static int grant_user_access(int core_fd, const Context *context) {
++ int at_secure = -1;
++ uid_t uid = UID_INVALID, euid = UID_INVALID;
++ uid_t gid = GID_INVALID, egid = GID_INVALID;
++ int r;
++
++ assert(core_fd >= 0);
++ assert(context);
++
++ if (!context->meta[META_PROC_AUXV])
++ return log_warning_errno(SYNTHETIC_ERRNO(ENODATA), "No auxv data, not adjusting permissions.");
++
++ uint8_t elf[EI_NIDENT];
++ errno = 0;
++ if (pread(core_fd, &elf, sizeof(elf), 0) != sizeof(elf))
++ return log_warning_errno(errno_or_else(EIO),
++ "Failed to pread from coredump fd: %s", errno != 0 ? strerror_safe(errno) : "Unexpected EOF");
++
++ if (elf[EI_MAG0] != ELFMAG0 ||
++ elf[EI_MAG1] != ELFMAG1 ||
++ elf[EI_MAG2] != ELFMAG2 ||
++ elf[EI_MAG3] != ELFMAG3 ||
++ elf[EI_VERSION] != EV_CURRENT)
++ return log_info_errno(SYNTHETIC_ERRNO(EUCLEAN),
++ "Core file does not have ELF header, not adjusting permissions.");
++ if (!IN_SET(elf[EI_CLASS], ELFCLASS32, ELFCLASS64) ||
++ !IN_SET(elf[EI_DATA], ELFDATA2LSB, ELFDATA2MSB))
++ return log_info_errno(SYNTHETIC_ERRNO(EUCLEAN),
++ "Core file has strange ELF class, not adjusting permissions.");
++
++ if ((elf[EI_DATA] == ELFDATA2LSB) != (__BYTE_ORDER == __LITTLE_ENDIAN))
++ return log_info_errno(SYNTHETIC_ERRNO(EUCLEAN),
++ "Core file has non-native endianness, not adjusting permissions.");
++
++ if (elf[EI_CLASS] == ELFCLASS64)
++ r = parse_auxv64((const uint64_t*) context->meta[META_PROC_AUXV],
++ context->meta_size[META_PROC_AUXV],
++ &at_secure, &uid, &euid, &gid, &egid);
++ else
++ r = parse_auxv32((const uint32_t*) context->meta[META_PROC_AUXV],
++ context->meta_size[META_PROC_AUXV],
++ &at_secure, &uid, &euid, &gid, &egid);
++ if (r < 0)
++ return r;
++
++ /* We allow access if we got all the data and at_secure is not set and
++ * the uid/gid matches euid/egid. */
++ bool ret =
++ at_secure == 0 &&
++ uid != UID_INVALID && euid != UID_INVALID && uid == euid &&
++ gid != GID_INVALID && egid != GID_INVALID && gid == egid;
++ log_debug("Will %s access (uid="UID_FMT " euid="UID_FMT " gid="GID_FMT " egid="GID_FMT " at_secure=%s)",
++ ret ? "permit" : "restrict",
++ uid, euid, gid, egid, yes_no(at_secure));
++ return ret;
++}
++
+ static int save_external_coredump(
+ const Context *context,
+ int input_fd,
+@@ -446,6 +601,8 @@ static int save_external_coredump(
+ context->meta[META_ARGV_PID], context->meta[META_COMM]);
+ truncated = r == 1;
+
++ bool allow_user = grant_user_access(fd, context) > 0;
++
+ #if HAVE_COMPRESSION
+ if (arg_compress) {
+ _cleanup_(unlink_and_freep) char *tmp_compressed = NULL;
+@@ -483,7 +640,7 @@ static int save_external_coredump(
+ uncompressed_size += partial_uncompressed_size;
+ }
+
+- r = fix_permissions(fd_compressed, tmp_compressed, fn_compressed, context, uid);
++ r = fix_permissions(fd_compressed, tmp_compressed, fn_compressed, context, uid, allow_user);
+ if (r < 0)
+ return r;
+
+@@ -510,7 +667,7 @@ static int save_external_coredump(
+ "SIZE_LIMIT=%zu", max_size,
+ "MESSAGE_ID=" SD_MESSAGE_TRUNCATED_CORE_STR);
+
+- r = fix_permissions(fd, tmp, fn, context, uid);
++ r = fix_permissions(fd, tmp, fn, context, uid, allow_user);
+ if (r < 0)
+ return log_error_errno(r, "Failed to fix permissions and finalize coredump %s into %s: %m", coredump_tmpfile_name(tmp), fn);
+
+@@ -758,7 +915,7 @@ static int change_uid_gid(const Context *context) {
+ }
+
+ static int submit_coredump(
+- Context *context,
++ const Context *context,
+ struct iovec_wrapper *iovw,
+ int input_fd) {
+
+@@ -919,16 +1076,15 @@ static int save_context(Context *context, const struct iovec_wrapper *iovw) {
+ struct iovec *iovec = iovw->iovec + n;
+
+ for (size_t i = 0; i < ELEMENTSOF(meta_field_names); i++) {
+- char *p;
+-
+ /* Note that these strings are NUL terminated, because we made sure that a
+ * trailing NUL byte is in the buffer, though not included in the iov_len
+ * count (see process_socket() and gather_pid_metadata_*()) */
+ assert(((char*) iovec->iov_base)[iovec->iov_len] == 0);
+
+- p = startswith(iovec->iov_base, meta_field_names[i]);
++ const char *p = startswith(iovec->iov_base, meta_field_names[i]);
+ if (p) {
+ context->meta[i] = p;
++ context->meta_size[i] = iovec->iov_len - strlen(meta_field_names[i]);
+ count++;
+ break;
+ }
+@@ -1170,6 +1326,7 @@ static int gather_pid_metadata(struct iovec_wrapper *iovw, Context *context) {
+ uid_t owner_uid;
+ pid_t pid;
+ char *t;
++ size_t size;
+ const char *p;
+ int r;
+
+@@ -1234,13 +1391,26 @@ static int gather_pid_metadata(struct iovec_wrapper *iovw, Context *context) {
+ (void) iovw_put_string_field_free(iovw, "COREDUMP_PROC_LIMITS=", t);
+
+ p = procfs_file_alloca(pid, "cgroup");
+- if (read_full_virtual_file(p, &t, NULL) >=0)
++ if (read_full_virtual_file(p, &t, NULL) >= 0)
+ (void) iovw_put_string_field_free(iovw, "COREDUMP_PROC_CGROUP=", t);
+
+ p = procfs_file_alloca(pid, "mountinfo");
+- if (read_full_virtual_file(p, &t, NULL) >=0)
++ if (read_full_virtual_file(p, &t, NULL) >= 0)
+ (void) iovw_put_string_field_free(iovw, "COREDUMP_PROC_MOUNTINFO=", t);
+
++ /* We attach /proc/auxv here. ELF coredumps also contain a note for this (NT_AUXV), see elf(5). */
++ p = procfs_file_alloca(pid, "auxv");
++ if (read_full_virtual_file(p, &t, &size) >= 0) {
++ char *buf = malloc(strlen("COREDUMP_PROC_AUXV=") + size + 1);
++ if (buf) {
++ /* Add a dummy terminator to make save_context() happy. */
++ *((uint8_t*) mempcpy(stpcpy(buf, "COREDUMP_PROC_AUXV="), t, size)) = '\0';
++ (void) iovw_consume(iovw, buf, size + strlen("COREDUMP_PROC_AUXV="));
++ }
++
++ free(t);
++ }
++
+ if (get_process_cwd(pid, &t) >= 0)
+ (void) iovw_put_string_field_free(iovw, "COREDUMP_CWD=", t);
+
+--
+2.30.2
+
diff --git a/meta/recipes-core/systemd/systemd_250.5.bb b/meta/recipes-core/systemd/systemd_250.5.bb
index ef524e0e3d..5405e4b6b3 100644
--- a/meta/recipes-core/systemd/systemd_250.5.bb
+++ b/meta/recipes-core/systemd/systemd_250.5.bb
@@ -28,6 +28,8 @@ SRC_URI += "file://touchscreen.rules \
file://CVE-2022-3821.patch \
file://CVE-2022-45873.patch \
file://0001-shared-json-allow-json_variant_dump-to-return-an-err.patch \
+ file://CVE-2022-4415-1.patch \
+ file://CVE-2022-4415-2.patch \
"
# patches needed by musl
--
2.34.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [OE-core][kirkstone 03/14] git: ignore CVE-2023-22743
2023-03-23 21:04 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 01/14] curl: Add fix for CVE-2023-23914, CVE-2023-23915 Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 02/14] systemd: fix CVE-2022-4415 Steve Sakoman
@ 2023-03-23 21:04 ` Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 04/14] devtool/upgrade: do not delete the workspace/recipes directory Steve Sakoman
` (10 subsequent siblings)
13 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-03-23 21:04 UTC (permalink / raw)
To: openembedded-core
From: Chee Yang Lee <chee.yang.lee@intel.com>
Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
(cherry picked from commit 70adf86b515934168a6185dcff4a8edb39a40017)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/git/git_2.35.7.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/recipes-devtools/git/git_2.35.7.bb b/meta/recipes-devtools/git/git_2.35.7.bb
index 7cc8e5722b..faf0b67051 100644
--- a/meta/recipes-devtools/git/git_2.35.7.bb
+++ b/meta/recipes-devtools/git/git_2.35.7.bb
@@ -33,6 +33,8 @@ CVE_PRODUCT = "git-scm:git"
CVE_CHECK_IGNORE += "CVE-2022-24975"
# This is specific to Git-for-Windows
CVE_CHECK_IGNORE += "CVE-2022-41953"
+# specific to Git for Windows
+CVE_CHECK_IGNORE += "CVE-2023-22743"
PACKAGECONFIG ??= "expat curl"
PACKAGECONFIG[cvsserver] = ""
--
2.34.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [OE-core][kirkstone 04/14] devtool/upgrade: do not delete the workspace/recipes directory
2023-03-23 21:04 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
` (2 preceding siblings ...)
2023-03-23 21:04 ` [OE-core][kirkstone 03/14] git: ignore CVE-2023-22743 Steve Sakoman
@ 2023-03-23 21:04 ` Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 05/14] systemd.bbclass: Add /usr/lib/systemd to searchpaths as well Steve Sakoman
` (9 subsequent siblings)
13 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-03-23 21:04 UTC (permalink / raw)
To: openembedded-core
From: Alexander Kanavin <alex.kanavin@gmail.com>
If it exists, there is no need to delete it, and if it does not,
devtool prints an ugly traceback.
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit af82e59e8f08369aabd5fa6eb43022982d4e59a7)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
scripts/lib/devtool/upgrade.py | 3 ---
1 file changed, 3 deletions(-)
diff --git a/scripts/lib/devtool/upgrade.py b/scripts/lib/devtool/upgrade.py
index 967d157077..6c4a62b558 100644
--- a/scripts/lib/devtool/upgrade.py
+++ b/scripts/lib/devtool/upgrade.py
@@ -125,11 +125,8 @@ def _write_append(rc, srctreebase, srctree, same_dir, no_same_dir, rev, copied,
return af
def _cleanup_on_error(rd, srctree):
- rdp = os.path.split(rd)[0] # recipes folder
if os.path.exists(rd):
shutil.rmtree(rd)
- if not len(os.listdir(rdp)):
- os.rmdir(rdp)
srctree = os.path.abspath(srctree)
if os.path.exists(srctree):
shutil.rmtree(srctree)
--
2.34.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [OE-core][kirkstone 05/14] systemd.bbclass: Add /usr/lib/systemd to searchpaths as well
2023-03-23 21:04 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
` (3 preceding siblings ...)
2023-03-23 21:04 ` [OE-core][kirkstone 04/14] devtool/upgrade: do not delete the workspace/recipes directory Steve Sakoman
@ 2023-03-23 21:04 ` Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 06/14] image_types: fix multiubi var init Steve Sakoman
` (8 subsequent siblings)
13 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-03-23 21:04 UTC (permalink / raw)
To: openembedded-core
From: Khem Raj <raj.khem@gmail.com>
Some packages like lirc places its unit files into $systemd_user_unitdir
and also uses them in SYSTEMD_SERVICE list in recipe. This fails in
do_package
ERROR: Didn't find service unit 'lircmd.service', specified in SYSTEMD_SERVICE:lirc.
here lircmd.service is installed in /usr/lib/systemd/system/lircmd.service
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 12808a4159835b67d8d53d32bc9135811701a779)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/classes/systemd.bbclass | 1 +
1 file changed, 1 insertion(+)
diff --git a/meta/classes/systemd.bbclass b/meta/classes/systemd.bbclass
index 09ec52792d..c07332d5b6 100644
--- a/meta/classes/systemd.bbclass
+++ b/meta/classes/systemd.bbclass
@@ -146,6 +146,7 @@ python systemd_populate_packages() {
def systemd_check_services():
searchpaths = [oe.path.join(d.getVar("sysconfdir"), "systemd", "system"),]
searchpaths.append(d.getVar("systemd_system_unitdir"))
+ searchpaths.append(d.getVar("systemd_user_unitdir"))
systemd_packages = d.getVar('SYSTEMD_PACKAGES')
keys = 'Also'
--
2.34.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [OE-core][kirkstone 06/14] image_types: fix multiubi var init
2023-03-23 21:04 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
` (4 preceding siblings ...)
2023-03-23 21:04 ` [OE-core][kirkstone 05/14] systemd.bbclass: Add /usr/lib/systemd to searchpaths as well Steve Sakoman
@ 2023-03-23 21:04 ` Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 07/14] oeqa rtc.py: skip if read-only-rootfs Steve Sakoman
` (7 subsequent siblings)
13 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-03-23 21:04 UTC (permalink / raw)
To: openembedded-core
From: Romuald Jeanne <romuald.jeanne@st.com>
Make sure to expand all MKUBIFS_ARGS_<label> and UBINIZE_ARGS_<label> vars
in 'do_image_multiubi' task to use them to init the local 'mkubifs_args'
and 'ubinize_args' vars.
See [YOCTO #15065]
Signed-off-by: Romuald JEANNE <romuald.jeanne@st.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 09d05215cf61981c7bc828cc0ff64c2fd5edc43c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/classes/image_types.bbclass | 3 +++
1 file changed, 3 insertions(+)
diff --git a/meta/classes/image_types.bbclass b/meta/classes/image_types.bbclass
index 960dab1a60..79081d9f98 100644
--- a/meta/classes/image_types.bbclass
+++ b/meta/classes/image_types.bbclass
@@ -187,7 +187,10 @@ multiubi_mkfs() {
fi
}
+MULTIUBI_ARGS = "MKUBIFS_ARGS UBINIZE_ARGS"
+
IMAGE_CMD:multiubi () {
+ ${@' '.join(['%s_%s="%s";' % (arg, name, d.getVar('%s_%s' % (arg, name))) for arg in d.getVar('MULTIUBI_ARGS').split() for name in d.getVar('MULTIUBI_BUILD').split()])}
# Split MKUBIFS_ARGS_<name> and UBINIZE_ARGS_<name>
for name in ${MULTIUBI_BUILD}; do
eval local mkubifs_args=\"\$MKUBIFS_ARGS_${name}\"
--
2.34.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [OE-core][kirkstone 07/14] oeqa rtc.py: skip if read-only-rootfs
2023-03-23 21:04 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
` (5 preceding siblings ...)
2023-03-23 21:04 ` [OE-core][kirkstone 06/14] image_types: fix multiubi var init Steve Sakoman
@ 2023-03-23 21:04 ` Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 08/14] lib/resulttool: fix typo breaking resulttool log --ptest Steve Sakoman
` (6 subsequent siblings)
13 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-03-23 21:04 UTC (permalink / raw)
To: openembedded-core
From: Mikko Rapeli <mikko.rapeli@linaro.org>
hwclock command fails on read-only-rootfs:
AssertionError: 1 != 0 : Failed to reset RTC time, output: hwclock: cannot open /etc/adjtime: Read-only file system
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 017bf8c160f6ab67d9f8e8d9e30b15bf84f73807)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/lib/oeqa/runtime/cases/rtc.py | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/meta/lib/oeqa/runtime/cases/rtc.py b/meta/lib/oeqa/runtime/cases/rtc.py
index c4e6681324..39f4d29f23 100644
--- a/meta/lib/oeqa/runtime/cases/rtc.py
+++ b/meta/lib/oeqa/runtime/cases/rtc.py
@@ -1,5 +1,6 @@
from oeqa.runtime.case import OERuntimeTestCase
from oeqa.core.decorator.depends import OETestDepends
+from oeqa.core.decorator.data import skipIfFeature
from oeqa.runtime.decorator.package import OEHasPackage
import re
@@ -16,12 +17,14 @@ class RTCTest(OERuntimeTestCase):
self.logger.debug('Starting systemd-timesyncd daemon')
self.target.run('systemctl enable --now --runtime systemd-timesyncd')
+ @skipIfFeature('read-only-rootfs',
+ 'Test does not work with read-only-rootfs in IMAGE_FEATURES')
@OETestDepends(['ssh.SSHTest.test_ssh'])
@OEHasPackage(['coreutils', 'busybox'])
def test_rtc(self):
(status, output) = self.target.run('hwclock -r')
self.assertEqual(status, 0, msg='Failed to get RTC time, output: %s' % output)
-
+
(status, current_datetime) = self.target.run('date +"%m%d%H%M%Y"')
self.assertEqual(status, 0, msg='Failed to get system current date & time, output: %s' % current_datetime)
@@ -32,7 +35,6 @@ class RTCTest(OERuntimeTestCase):
(status, output) = self.target.run('date %s' % current_datetime)
self.assertEqual(status, 0, msg='Failed to reset system date & time, output: %s' % output)
-
+
(status, output) = self.target.run('hwclock -w')
self.assertEqual(status, 0, msg='Failed to reset RTC time, output: %s' % output)
-
--
2.34.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [OE-core][kirkstone 08/14] lib/resulttool: fix typo breaking resulttool log --ptest
2023-03-23 21:04 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
` (6 preceding siblings ...)
2023-03-23 21:04 ` [OE-core][kirkstone 07/14] oeqa rtc.py: skip if read-only-rootfs Steve Sakoman
@ 2023-03-23 21:04 ` Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 09/14] timezone: use 'tz' subdir instead of ${WORKDIR} directly Steve Sakoman
` (5 subsequent siblings)
13 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-03-23 21:04 UTC (permalink / raw)
To: openembedded-core
From: Ross Burton <ross.burton@arm.com>
ptestresult_get_log() looked for a key called 'ptestresuls.sections',
which should be 'ptestresult.sections'
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 7c8c9f7283e54bf8b1521fbaad7dceb66a8fcdbb)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
scripts/lib/resulttool/resultutils.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/scripts/lib/resulttool/resultutils.py b/scripts/lib/resulttool/resultutils.py
index 8917022d36..7666331ba2 100644
--- a/scripts/lib/resulttool/resultutils.py
+++ b/scripts/lib/resulttool/resultutils.py
@@ -142,7 +142,7 @@ def generic_get_log(sectionname, results, section):
return decode_log(ptest['log'])
def ptestresult_get_log(results, section):
- return generic_get_log('ptestresuls.sections', results, section)
+ return generic_get_log('ptestresult.sections', results, section)
def generic_get_rawlogs(sectname, results):
if sectname not in results:
--
2.34.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [OE-core][kirkstone 09/14] timezone: use 'tz' subdir instead of ${WORKDIR} directly
2023-03-23 21:04 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
` (7 preceding siblings ...)
2023-03-23 21:04 ` [OE-core][kirkstone 08/14] lib/resulttool: fix typo breaking resulttool log --ptest Steve Sakoman
@ 2023-03-23 21:04 ` Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 10/14] tzdata: use separate B instead of WORKDIR for zic output Steve Sakoman
` (4 subsequent siblings)
13 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-03-23 21:04 UTC (permalink / raw)
To: openembedded-core
From: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit bc53ccaf82c57826acac5f9c2557e403ec367807)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-extended/timezone/timezone.inc | 6 ++++--
meta/recipes-extended/timezone/tzcode-native.bb | 3 ---
meta/recipes-extended/timezone/tzdata.bb | 2 --
3 files changed, 4 insertions(+), 7 deletions(-)
diff --git a/meta/recipes-extended/timezone/timezone.inc b/meta/recipes-extended/timezone/timezone.inc
index 1834665a1e..eec7177228 100644
--- a/meta/recipes-extended/timezone/timezone.inc
+++ b/meta/recipes-extended/timezone/timezone.inc
@@ -8,10 +8,12 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=c679c9d6b02bc2757b3eaf8f53c43fba"
PV = "2022g"
-SRC_URI =" http://www.iana.org/time-zones/repository/releases/tzcode${PV}.tar.gz;name=tzcode \
- http://www.iana.org/time-zones/repository/releases/tzdata${PV}.tar.gz;name=tzdata \
+SRC_URI =" http://www.iana.org/time-zones/repository/releases/tzcode${PV}.tar.gz;name=tzcode;subdir=tz \
+ http://www.iana.org/time-zones/repository/releases/tzdata${PV}.tar.gz;name=tzdata;subdir=tz \
"
+S = "${WORKDIR}/tz"
+
UPSTREAM_CHECK_URI = "http://www.iana.org/time-zones"
SRC_URI[tzcode.sha256sum] = "9610bb0b9656ff404c361a41f3286da53064b5469d84f00c9cb2314c8614da74"
diff --git a/meta/recipes-extended/timezone/tzcode-native.bb b/meta/recipes-extended/timezone/tzcode-native.bb
index e3582ba674..d0b23a9d80 100644
--- a/meta/recipes-extended/timezone/tzcode-native.bb
+++ b/meta/recipes-extended/timezone/tzcode-native.bb
@@ -1,10 +1,7 @@
require timezone.inc
-#
SUMMARY = "tzcode, timezone zoneinfo utils -- zic, zdump, tzselect"
-S = "${WORKDIR}"
-
inherit native
EXTRA_OEMAKE += "cc='${CC}'"
diff --git a/meta/recipes-extended/timezone/tzdata.bb b/meta/recipes-extended/timezone/tzdata.bb
index 7f4322d867..ce725008c0 100644
--- a/meta/recipes-extended/timezone/tzdata.bb
+++ b/meta/recipes-extended/timezone/tzdata.bb
@@ -4,8 +4,6 @@ DEPENDS = "tzcode-native"
inherit allarch
-S = "${WORKDIR}"
-
DEFAULT_TIMEZONE ?= "Universal"
INSTALL_TIMEZONE_FILE ?= "1"
--
2.34.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [OE-core][kirkstone 10/14] tzdata: use separate B instead of WORKDIR for zic output
2023-03-23 21:04 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
` (8 preceding siblings ...)
2023-03-23 21:04 ` [OE-core][kirkstone 09/14] timezone: use 'tz' subdir instead of ${WORKDIR} directly Steve Sakoman
@ 2023-03-23 21:04 ` Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 11/14] tzcode-native: fix build with gcc-13 on host Steve Sakoman
` (3 subsequent siblings)
13 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-03-23 21:04 UTC (permalink / raw)
To: openembedded-core
From: Martin Jansa <Martin.Jansa@gmail.com>
* avoid copying whole exec_prefix over base_prefix as there
were only zoneinfo files anyway
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 37846f8735683ed0fab5ef5c12d77c6041348801)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-extended/timezone/tzdata.bb | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/meta/recipes-extended/timezone/tzdata.bb b/meta/recipes-extended/timezone/tzdata.bb
index ce725008c0..dd1960ffa7 100644
--- a/meta/recipes-extended/timezone/tzdata.bb
+++ b/meta/recipes-extended/timezone/tzdata.bb
@@ -16,17 +16,21 @@ TZONES = " \
# "fat" is needed by e.g. MariaDB's mysql_tzinfo_to_sql
ZIC_FMT ?= "slim"
+do_configure[cleandirs] = "${B}"
+B = "${WORKDIR}/build"
+
do_compile() {
for zone in ${TZONES}; do
- ${STAGING_BINDIR_NATIVE}/zic -b ${ZIC_FMT} -d ${WORKDIR}${datadir}/zoneinfo -L /dev/null ${S}/${zone}
- ${STAGING_BINDIR_NATIVE}/zic -b ${ZIC_FMT} -d ${WORKDIR}${datadir}/zoneinfo/posix -L /dev/null ${S}/${zone}
- ${STAGING_BINDIR_NATIVE}/zic -b ${ZIC_FMT} -d ${WORKDIR}${datadir}/zoneinfo/right -L ${S}/leapseconds ${S}/${zone}
+ ${STAGING_BINDIR_NATIVE}/zic -b ${ZIC_FMT} -d ${B}/zoneinfo -L /dev/null ${S}/${zone}
+ ${STAGING_BINDIR_NATIVE}/zic -b ${ZIC_FMT} -d ${B}/zoneinfo/posix -L /dev/null ${S}/${zone}
+ ${STAGING_BINDIR_NATIVE}/zic -b ${ZIC_FMT} -d ${B}/zoneinfo/right -L ${S}/leapseconds ${S}/${zone}
done
}
do_install() {
- install -d ${D}$exec_prefix ${D}${datadir}/zoneinfo
- cp -pPR ${WORKDIR}$exec_prefix ${D}${base_prefix}
+ install -d ${D}${datadir}/zoneinfo
+ cp -pPR ${B}/zoneinfo/* ${D}${datadir}/zoneinfo
+
# libc is removing zoneinfo files from package
cp -pP "${S}/zone.tab" ${D}${datadir}/zoneinfo
cp -pP "${S}/zone1970.tab" ${D}${datadir}/zoneinfo
--
2.34.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [OE-core][kirkstone 11/14] tzcode-native: fix build with gcc-13 on host
2023-03-23 21:04 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
` (9 preceding siblings ...)
2023-03-23 21:04 ` [OE-core][kirkstone 10/14] tzdata: use separate B instead of WORKDIR for zic output Steve Sakoman
@ 2023-03-23 21:04 ` Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 12/14] pybootchartui: Fix python syntax issue Steve Sakoman
` (2 subsequent siblings)
13 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-03-23 21:04 UTC (permalink / raw)
To: openembedded-core
From: Martin Jansa <Martin.Jansa@gmail.com>
* passing -std=c2x to avoid build failure with gcc-13 on host
works as well, but the resulting zic then segfaults when
used in tzdata, use a fix from upstream instead
* reported upstream in https://mm.icann.org/pipermail/tz/2023-March/032690.html
* fixes:
http://errors.yoctoproject.org/Errors/Details/697913/
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 5dabf677f38c209fb6a8ba837d5a66fd89f57d4d)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../timezone/tzcode-native.bb | 2 +
...0001-Fix-C23-related-conformance-bug.patch | 301 ++++++++++++++++++
2 files changed, 303 insertions(+)
create mode 100644 meta/recipes-extended/timezone/tzcode/0001-Fix-C23-related-conformance-bug.patch
diff --git a/meta/recipes-extended/timezone/tzcode-native.bb b/meta/recipes-extended/timezone/tzcode-native.bb
index d0b23a9d80..6d52b3c422 100644
--- a/meta/recipes-extended/timezone/tzcode-native.bb
+++ b/meta/recipes-extended/timezone/tzcode-native.bb
@@ -2,6 +2,8 @@ require timezone.inc
SUMMARY = "tzcode, timezone zoneinfo utils -- zic, zdump, tzselect"
+SRC_URI += "file://0001-Fix-C23-related-conformance-bug.patch"
+
inherit native
EXTRA_OEMAKE += "cc='${CC}'"
diff --git a/meta/recipes-extended/timezone/tzcode/0001-Fix-C23-related-conformance-bug.patch b/meta/recipes-extended/timezone/tzcode/0001-Fix-C23-related-conformance-bug.patch
new file mode 100644
index 0000000000..c91ef93e95
--- /dev/null
+++ b/meta/recipes-extended/timezone/tzcode/0001-Fix-C23-related-conformance-bug.patch
@@ -0,0 +1,301 @@
+From 509c5974398952618abdd17f39117b88e3f50057 Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Thu, 1 Dec 2022 10:28:04 -0800
+Subject: [PATCH] Fix C23-related conformance bug
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Problem reported by Houge Langley for ‘gcc -std=gnu99’ in:
+https://bugs.gentoo.org/show_bug.cgi?id=883719
+* NEWS: Mention this.
+* date.c, localtime.c, private.h, zdump.c, zic.c:
+Use ATTRIBUTE_* at the start of function declarations,
+not later (such as after the keyword ‘static’).
+This is required for strict conformance to C23.
+
+Upstream-Status: Backport [https://github.com/eggert/tz/commit/9cfe9507fcc22cd4a0c4da486ea1c7f0de6b075f]
+
+NEWS change skipped to avoid conflicts.
+
+Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
+---
+ date.c | 2 +-
+ localtime.c | 4 ++--
+ private.h | 6 +++---
+ zdump.c | 12 ++++++------
+ zic.c | 34 +++++++++++++++++-----------------
+ 5 files changed, 29 insertions(+), 29 deletions(-)
+
+diff --git a/date.c b/date.c
+index 11c5e5fe..97df6ab0 100644
+--- a/date.c
++++ b/date.c
+@@ -42,7 +42,7 @@ static void display(const char *, time_t);
+ static void dogmt(void);
+ static void errensure(void);
+ static void timeout(FILE *, const char *, const struct tm *);
+-static ATTRIBUTE_NORETURN void usage(void);
++ATTRIBUTE_NORETURN static void usage(void);
+
+ int
+ main(const int argc, char *argv[])
+diff --git a/localtime.c b/localtime.c
+index 1d22d351..3bf1b911 100644
+--- a/localtime.c
++++ b/localtime.c
+@@ -838,7 +838,7 @@ is_digit(char c)
+ ** Return a pointer to that character.
+ */
+
+-static ATTRIBUTE_REPRODUCIBLE const char *
++ATTRIBUTE_REPRODUCIBLE static const char *
+ getzname(register const char *strp)
+ {
+ register char c;
+@@ -859,7 +859,7 @@ getzname(register const char *strp)
+ ** We don't do any checking here; checking is done later in common-case code.
+ */
+
+-static ATTRIBUTE_REPRODUCIBLE const char *
++ATTRIBUTE_REPRODUCIBLE static const char *
+ getqzname(register const char *strp, const int delim)
+ {
+ register int c;
+diff --git a/private.h b/private.h
+index 7a73eff7..ae522986 100644
+--- a/private.h
++++ b/private.h
+@@ -628,7 +628,7 @@ char *asctime(struct tm const *);
+ char *asctime_r(struct tm const *restrict, char *restrict);
+ char *ctime(time_t const *);
+ char *ctime_r(time_t const *, char *);
+-double difftime(time_t, time_t) ATTRIBUTE_UNSEQUENCED;
++ATTRIBUTE_UNSEQUENCED double difftime(time_t, time_t);
+ size_t strftime(char *restrict, size_t, char const *restrict,
+ struct tm const *restrict);
+ # if HAVE_STRFTIME_L
+@@ -740,10 +740,10 @@ timezone_t tzalloc(char const *);
+ void tzfree(timezone_t);
+ # ifdef STD_INSPIRED
+ # if TZ_TIME_T || !defined posix2time_z
+-time_t posix2time_z(timezone_t, time_t) ATTRIBUTE_REPRODUCIBLE;
++ATTRIBUTE_REPRODUCIBLE time_t posix2time_z(timezone_t, time_t);
+ # endif
+ # if TZ_TIME_T || !defined time2posix_z
+-time_t time2posix_z(timezone_t, time_t) ATTRIBUTE_REPRODUCIBLE;
++ATTRIBUTE_REPRODUCIBLE time_t time2posix_z(timezone_t, time_t);
+ # endif
+ # endif
+ #endif
+diff --git a/zdump.c b/zdump.c
+index 7acb3e2d..3e482ba3 100644
+--- a/zdump.c
++++ b/zdump.c
+@@ -89,7 +89,7 @@ static bool warned;
+ static bool errout;
+
+ static char const *abbr(struct tm const *);
+-static intmax_t delta(struct tm *, struct tm *) ATTRIBUTE_REPRODUCIBLE;
++ATTRIBUTE_REPRODUCIBLE static intmax_t delta(struct tm *, struct tm *);
+ static void dumptime(struct tm const *);
+ static time_t hunt(timezone_t, time_t, time_t, bool);
+ static void show(timezone_t, char *, time_t, bool);
+@@ -97,7 +97,7 @@ static void showextrema(timezone_t, char *, time_t, struct tm *, time_t);
+ static void showtrans(char const *, struct tm const *, time_t, char const *,
+ char const *);
+ static const char *tformat(void);
+-static time_t yeartot(intmax_t) ATTRIBUTE_REPRODUCIBLE;
++ATTRIBUTE_REPRODUCIBLE static time_t yeartot(intmax_t);
+
+ /* Is C an ASCII digit? */
+ static bool
+@@ -125,7 +125,7 @@ is_alpha(char a)
+ }
+ }
+
+-static ATTRIBUTE_NORETURN void
++ATTRIBUTE_NORETURN static void
+ size_overflow(void)
+ {
+ fprintf(stderr, _("%s: size overflow\n"), progname);
+@@ -134,7 +134,7 @@ size_overflow(void)
+
+ /* Return A + B, exiting if the result would overflow either ptrdiff_t
+ or size_t. */
+-static ATTRIBUTE_REPRODUCIBLE ptrdiff_t
++ATTRIBUTE_REPRODUCIBLE static ptrdiff_t
+ sumsize(size_t a, size_t b)
+ {
+ #ifdef ckd_add
+@@ -151,7 +151,7 @@ sumsize(size_t a, size_t b)
+
+ /* Return a pointer to a newly allocated buffer of size SIZE, exiting
+ on failure. SIZE should be nonzero. */
+-static void * ATTRIBUTE_MALLOC
++ATTRIBUTE_MALLOC static void *
+ xmalloc(size_t size)
+ {
+ void *p = malloc(size);
+@@ -920,7 +920,7 @@ showextrema(timezone_t tz, char *zone, time_t lo, struct tm *lotmp, time_t hi)
+ # include <stdarg.h>
+
+ /* A substitute for snprintf that is good enough for zdump. */
+-static int ATTRIBUTE_FORMAT((printf, 3, 4))
++ATTRIBUTE_FORMAT((printf, 3, 4)) static int
+ my_snprintf(char *s, size_t size, char const *format, ...)
+ {
+ int n;
+diff --git a/zic.c b/zic.c
+index 892414af..f143fcef 100644
+--- a/zic.c
++++ b/zic.c
+@@ -459,20 +459,20 @@ static char roll[TZ_MAX_LEAPS];
+ ** Memory allocation.
+ */
+
+-static ATTRIBUTE_NORETURN void
++ATTRIBUTE_NORETURN static void
+ memory_exhausted(const char *msg)
+ {
+ fprintf(stderr, _("%s: Memory exhausted: %s\n"), progname, msg);
+ exit(EXIT_FAILURE);
+ }
+
+-static ATTRIBUTE_NORETURN void
++ATTRIBUTE_NORETURN static void
+ size_overflow(void)
+ {
+ memory_exhausted(_("size overflow"));
+ }
+
+-static ATTRIBUTE_REPRODUCIBLE ptrdiff_t
++ATTRIBUTE_REPRODUCIBLE static ptrdiff_t
+ size_sum(size_t a, size_t b)
+ {
+ #ifdef ckd_add
+@@ -487,7 +487,7 @@ size_sum(size_t a, size_t b)
+ size_overflow();
+ }
+
+-static ATTRIBUTE_REPRODUCIBLE ptrdiff_t
++ATTRIBUTE_REPRODUCIBLE static ptrdiff_t
+ size_product(ptrdiff_t nitems, ptrdiff_t itemsize)
+ {
+ #ifdef ckd_mul
+@@ -502,7 +502,7 @@ size_product(ptrdiff_t nitems, ptrdiff_t itemsize)
+ size_overflow();
+ }
+
+-static ATTRIBUTE_REPRODUCIBLE ptrdiff_t
++ATTRIBUTE_REPRODUCIBLE static ptrdiff_t
+ align_to(ptrdiff_t size, ptrdiff_t alignment)
+ {
+ ptrdiff_t lo_bits = alignment - 1, sum = size_sum(size, lo_bits);
+@@ -526,7 +526,7 @@ memcheck(void *ptr)
+ return ptr;
+ }
+
+-static void * ATTRIBUTE_MALLOC
++ATTRIBUTE_MALLOC static void *
+ emalloc(size_t size)
+ {
+ return memcheck(malloc(size));
+@@ -538,7 +538,7 @@ erealloc(void *ptr, size_t size)
+ return memcheck(realloc(ptr, size));
+ }
+
+-static char * ATTRIBUTE_MALLOC
++ATTRIBUTE_MALLOC static char *
+ estrdup(char const *str)
+ {
+ return memcheck(strdup(str));
+@@ -608,7 +608,7 @@ eat(int fnum, lineno num)
+ eats(fnum, num, 0, -1);
+ }
+
+-static void ATTRIBUTE_FORMAT((printf, 1, 0))
++ATTRIBUTE_FORMAT((printf, 1, 0)) static void
+ verror(const char *const string, va_list args)
+ {
+ /*
+@@ -626,7 +626,7 @@ verror(const char *const string, va_list args)
+ fprintf(stderr, "\n");
+ }
+
+-static void ATTRIBUTE_FORMAT((printf, 1, 2))
++ATTRIBUTE_FORMAT((printf, 1, 2)) static void
+ error(const char *const string, ...)
+ {
+ va_list args;
+@@ -636,7 +636,7 @@ error(const char *const string, ...)
+ errors = true;
+ }
+
+-static void ATTRIBUTE_FORMAT((printf, 1, 2))
++ATTRIBUTE_FORMAT((printf, 1, 2)) static void
+ warning(const char *const string, ...)
+ {
+ va_list args;
+@@ -666,7 +666,7 @@ close_file(FILE *stream, char const *dir, char const *name,
+ }
+ }
+
+-static ATTRIBUTE_NORETURN void
++ATTRIBUTE_NORETURN static void
+ usage(FILE *stream, int status)
+ {
+ fprintf(stream,
+@@ -3597,7 +3597,7 @@ lowerit(char a)
+ }
+
+ /* case-insensitive equality */
+-static ATTRIBUTE_REPRODUCIBLE bool
++ATTRIBUTE_REPRODUCIBLE static bool
+ ciequal(register const char *ap, register const char *bp)
+ {
+ while (lowerit(*ap) == lowerit(*bp++))
+@@ -3606,7 +3606,7 @@ ciequal(register const char *ap, register const char *bp)
+ return false;
+ }
+
+-static ATTRIBUTE_REPRODUCIBLE bool
++ATTRIBUTE_REPRODUCIBLE static bool
+ itsabbr(register const char *abbr, register const char *word)
+ {
+ if (lowerit(*abbr) != lowerit(*word))
+@@ -3622,7 +3622,7 @@ itsabbr(register const char *abbr, register const char *word)
+
+ /* Return true if ABBR is an initial prefix of WORD, ignoring ASCII case. */
+
+-static ATTRIBUTE_REPRODUCIBLE bool
++ATTRIBUTE_REPRODUCIBLE static bool
+ ciprefix(char const *abbr, char const *word)
+ {
+ do
+@@ -3725,14 +3725,14 @@ getfields(char *cp, char **array, int arrayelts)
+ return nsubs;
+ }
+
+-static ATTRIBUTE_NORETURN void
++ATTRIBUTE_NORETURN static void
+ time_overflow(void)
+ {
+ error(_("time overflow"));
+ exit(EXIT_FAILURE);
+ }
+
+-static ATTRIBUTE_REPRODUCIBLE zic_t
++ATTRIBUTE_REPRODUCIBLE static zic_t
+ oadd(zic_t t1, zic_t t2)
+ {
+ #ifdef ckd_add
+@@ -3746,7 +3746,7 @@ oadd(zic_t t1, zic_t t2)
+ time_overflow();
+ }
+
+-static ATTRIBUTE_REPRODUCIBLE zic_t
++ATTRIBUTE_REPRODUCIBLE static zic_t
+ tadd(zic_t t1, zic_t t2)
+ {
+ #ifdef ckd_add
--
2.34.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [OE-core][kirkstone 12/14] pybootchartui: Fix python syntax issue
2023-03-23 21:04 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
` (10 preceding siblings ...)
2023-03-23 21:04 ` [OE-core][kirkstone 11/14] tzcode-native: fix build with gcc-13 on host Steve Sakoman
@ 2023-03-23 21:04 ` Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 13/14] cracklib: update github branch to 'main' Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 14/14] systemd: fix wrong nobody-group assignment Steve Sakoman
13 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-03-23 21:04 UTC (permalink / raw)
To: openembedded-core
From: Richard Purdie <richard.purdie@linuxfoundation.org>
Fix:
scripts/pybootchartgui/pybootchartgui/parsing.py:134: SyntaxWarning: "is" with a literal. Did you mean "=="?
if pid is 0:
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c9a6511ae618035b8efad01646e37ba28ce1e3f8)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
scripts/pybootchartgui/pybootchartgui/parsing.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/scripts/pybootchartgui/pybootchartgui/parsing.py b/scripts/pybootchartgui/pybootchartgui/parsing.py
index b42dac6b88..9d6787ec5a 100644
--- a/scripts/pybootchartgui/pybootchartgui/parsing.py
+++ b/scripts/pybootchartgui/pybootchartgui/parsing.py
@@ -128,7 +128,7 @@ class Trace:
def compile(self, writer):
def find_parent_id_for(pid):
- if pid is 0:
+ if pid == 0:
return 0
ppid = self.parent_map.get(pid)
if ppid:
--
2.34.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [OE-core][kirkstone 13/14] cracklib: update github branch to 'main'
2023-03-23 21:04 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
` (11 preceding siblings ...)
2023-03-23 21:04 ` [OE-core][kirkstone 12/14] pybootchartui: Fix python syntax issue Steve Sakoman
@ 2023-03-23 21:04 ` Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 14/14] systemd: fix wrong nobody-group assignment Steve Sakoman
13 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-03-23 21:04 UTC (permalink / raw)
To: openembedded-core
From: Tim Orling <ticotimo@gmail.com>
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ab041ca5d036c2a1a1514893c6ffb5c7188ff00f)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-extended/cracklib/cracklib_2.9.8.bb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-extended/cracklib/cracklib_2.9.8.bb b/meta/recipes-extended/cracklib/cracklib_2.9.8.bb
index 786940a7e0..a3db6eb394 100644
--- a/meta/recipes-extended/cracklib/cracklib_2.9.8.bb
+++ b/meta/recipes-extended/cracklib/cracklib_2.9.8.bb
@@ -9,7 +9,7 @@ DEPENDS = "cracklib-native zlib"
EXTRA_OECONF = "--without-python --libdir=${base_libdir}"
-SRC_URI = "git://github.com/cracklib/cracklib;protocol=https;branch=master \
+SRC_URI = "git://github.com/cracklib/cracklib;protocol=https;branch=main \
file://0001-packlib.c-support-dictionary-byte-order-dependent.patch \
file://0002-craklib-fix-testnum-and-teststr-failed.patch \
"
--
2.34.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [OE-core][kirkstone 14/14] systemd: fix wrong nobody-group assignment
2023-03-23 21:04 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
` (12 preceding siblings ...)
2023-03-23 21:04 ` [OE-core][kirkstone 13/14] cracklib: update github branch to 'main' Steve Sakoman
@ 2023-03-23 21:04 ` Steve Sakoman
13 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-03-23 21:04 UTC (permalink / raw)
To: openembedded-core
From: Piotr Łobacz <p.lobacz@welotec.com>
The generated /etc/group file had a wrong group name for nobody-group
which was nobody with same id as nogroup groupd. This was leading to
duplcate groups, with same ids and different names.
More can be read on this link:
https://bugzilla.yoctoproject.org/show_bug.cgi?id=11766
Signed-off-by: Piotr Łobacz <p.lobacz@welotec.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit d69fccf2e5d108dd7c6059310924588d36a45865)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-core/systemd/systemd_250.5.bb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-core/systemd/systemd_250.5.bb b/meta/recipes-core/systemd/systemd_250.5.bb
index 5405e4b6b3..784a7af271 100644
--- a/meta/recipes-core/systemd/systemd_250.5.bb
+++ b/meta/recipes-core/systemd/systemd_250.5.bb
@@ -223,7 +223,7 @@ rootlibdir ?= "${base_libdir}"
rootlibexecdir = "${rootprefix}/lib"
EXTRA_OEMESON += "-Dnobody-user=nobody \
- -Dnobody-group=nobody \
+ -Dnobody-group=nogroup \
-Drootlibdir=${rootlibdir} \
-Drootprefix=${rootprefix} \
-Ddefault-locale=C \
--
2.34.1
^ permalink raw reply related [flat|nested] 20+ messages in thread
* [OE-core][kirkstone 00/14] Patch review
@ 2023-09-06 12:48 Steve Sakoman
0 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2023-09-06 12:48 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Friday, September 8.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/5835
The following changes since commit 8ceaeff90023e51c7e874464f026b30d24035bda:
python3-git: upgrade 3.1.27 -> 3.1.32 (2023-08-27 04:03:37 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Abe Kohandel (1):
libdnf: resolve cstdint inclusion for newer gcc versions
Adrian Freihofer (1):
json-c: fix CVE-2021-32292
Archana Polampalli (1):
nasm: fix CVE-2020-21528
Changqing Li (1):
sysklogd: fix integration with systemd-journald
Chee Yang Lee (3):
libssh2: fix CVE-2020-22218
file: fix CVE-2022-48554
python3: upgrade to 3.10.13
Hitendra Prajapati (2):
tiff: fix CVE-2023-2908,CVE-2023-3316,CVE-2023-3618
libtiff: fix CVE-2023-26966 Buffer Overflow
Kai Kang (1):
webkitgtk: fix CVE-2023-23529
Martin Jansa (1):
efivar: backport 5 patches to fix build with gold
Meenali Gupta (1):
busybox: fix CVE-2022-48174
Soumya Sambu (1):
ncurses: fix CVE-2023-29491
Vijay Anusuri (1):
inetutils: Backport fix for CVE-2023-40303
...ve-deprecated-add-needed-linker-flag.patch | 45 ++
...002-Add-T-workaround-for-GNU-ld-2.36.patch | 33 ++
...LL-C-to-force-English-output-from-ld.patch | 33 ++
...on-and-remove-not-needed-workarounds.patch | 45 ++
...mp-efi_well_known_-variable-handling.patch | 262 ++++++++++
meta/recipes-bsp/efivar/efivar_38.bb | 9 +-
...tpd-rcp-rlogin-rsh-rshd-uucpd-fix-ch.patch | 280 +++++++++++
...03-Indent-changes-in-previous-commit.patch | 254 ++++++++++
.../inetutils/inetutils_2.2.bb | 2 +
.../busybox/busybox/CVE-2022-48174.patch | 80 +++
meta/recipes-core/busybox/busybox_1.35.0.bb | 1 +
.../ncurses/files/CVE-2023-29491.patch | 464 ++++++++++++++++++
.../ncurses/ncurses_6.3+20220423.bb | 1 +
.../file/file/CVE-2022-48554.patch | 35 ++
meta/recipes-devtools/file/file_5.41.bb | 4 +-
.../json-c/json-c/CVE-2021-32292.patch | 30 ++
meta/recipes-devtools/json-c/json-c_0.15.bb | 1 +
...58-Don-t-assume-inclusion-of-cstdint.patch | 56 +++
...onNumber.hpp-add-missing-cstdint-inc.patch | 33 ++
...ite3-Sqlite3.hpp-add-missing-cstdint.patch | 36 ++
meta/recipes-devtools/libdnf/libdnf_0.66.0.bb | 3 +
.../nasm/nasm/CVE-2020-21528.patch | 47 ++
meta/recipes-devtools/nasm/nasm_2.15.05.bb | 1 +
...{python3_3.10.12.bb => python3_3.10.13.bb} | 2 +-
...KillMode-process-is-not-recommended-.patch | 33 ++
...-messages-lost-when-running-in-syste.patch | 75 +++
.../sysklogd/sysklogd_2.3.0.bb | 2 +
.../libtiff/tiff/CVE-2023-26966.patch | 35 ++
.../libtiff/tiff/CVE-2023-2908.patch | 33 ++
.../libtiff/tiff/CVE-2023-3316.patch | 59 +++
.../libtiff/tiff/CVE-2023-3618-1.patch | 34 ++
.../libtiff/tiff/CVE-2023-3618-2.patch | 47 ++
meta/recipes-multimedia/libtiff/tiff_4.3.0.bb | 5 +
.../webkit/webkitgtk/CVE-2023-23529.patch | 65 +++
meta/recipes-sato/webkit/webkitgtk_2.36.8.bb | 1 +
.../libssh2/libssh2/CVE-2020-22218.patch | 34 ++
.../recipes-support/libssh2/libssh2_1.10.0.bb | 1 +
37 files changed, 2175 insertions(+), 6 deletions(-)
create mode 100644 meta/recipes-bsp/efivar/efivar/0001-Remove-deprecated-add-needed-linker-flag.patch
create mode 100644 meta/recipes-bsp/efivar/efivar/0002-Add-T-workaround-for-GNU-ld-2.36.patch
create mode 100644 meta/recipes-bsp/efivar/efivar/0003-Set-LC_ALL-C-to-force-English-output-from-ld.patch
create mode 100644 meta/recipes-bsp/efivar/efivar/0004-LLD-fix-detection-and-remove-not-needed-workarounds.patch
create mode 100644 meta/recipes-bsp/efivar/efivar/0005-Revamp-efi_well_known_-variable-handling.patch
create mode 100644 meta/recipes-connectivity/inetutils/inetutils/0001-CVE-2023-40303-ftpd-rcp-rlogin-rsh-rshd-uucpd-fix-ch.patch
create mode 100644 meta/recipes-connectivity/inetutils/inetutils/0002-CVE-2023-40303-Indent-changes-in-previous-commit.patch
create mode 100644 meta/recipes-core/busybox/busybox/CVE-2022-48174.patch
create mode 100644 meta/recipes-core/ncurses/files/CVE-2023-29491.patch
create mode 100644 meta/recipes-devtools/file/file/CVE-2022-48554.patch
create mode 100644 meta/recipes-devtools/json-c/json-c/CVE-2021-32292.patch
create mode 100644 meta/recipes-devtools/libdnf/libdnf/0001-Fix-1558-Don-t-assume-inclusion-of-cstdint.patch
create mode 100644 meta/recipes-devtools/libdnf/libdnf/0001-libdnf-conf-OptionNumber.hpp-add-missing-cstdint-inc.patch
create mode 100644 meta/recipes-devtools/libdnf/libdnf/0001-libdnf-utils-sqlite3-Sqlite3.hpp-add-missing-cstdint.patch
create mode 100644 meta/recipes-devtools/nasm/nasm/CVE-2020-21528.patch
rename meta/recipes-devtools/python/{python3_3.10.12.bb => python3_3.10.13.bb} (99%)
create mode 100644 meta/recipes-extended/sysklogd/files/0001-syslogd.service-KillMode-process-is-not-recommended-.patch
create mode 100644 meta/recipes-extended/sysklogd/files/0002-Fix-62-early-log-messages-lost-when-running-in-syste.patch
create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2023-26966.patch
create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2023-2908.patch
create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2023-3316.patch
create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2023-3618-1.patch
create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2023-3618-2.patch
create mode 100644 meta/recipes-sato/webkit/webkitgtk/CVE-2023-23529.patch
create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2020-22218.patch
--
2.34.1
^ permalink raw reply [flat|nested] 20+ messages in thread
* [OE-core][kirkstone 00/14] Patch review
@ 2024-11-27 18:49 Steve Sakoman
0 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2024-11-27 18:49 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Friday, November 29
Passed a-full on autobuilder:
https://valkyrie.yoctoproject.org/#/builders/29/builds/537
The following changes since commit 8c10f4a4dc12f65212576e6e568fa4369014aaa0:
udev-extraconf: fix network.sh script did not configure hotplugged interfaces (2024-11-22 07:09:00 -0800)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Alexander Kanavin (2):
package_rpm: use zstd's default compression level
package_rpm: restrict rpm to 4 threads
Archana Polampalli (5):
ffmpeg: fix CVE-2023-51798
ffmpeg: fix CVE-2023-47342
ffmpeg: fix CVE-2023-50007
ffmpeg: fix CVE-2023-51796
ffmpeg: fix CVE-2024-7055
Chen Qi (1):
coreutils: fix CVE-2024-0684
Hitendra Prajapati (1):
libsndfile: fix CVE-2024-50612
Jiaying Song (1):
python3-pip: fix CVE-2023-5752
Jinfeng Wang (1):
tzdata&tzcode-native: upgrade 2024a -> 2024b
Markus Volk (1):
ninja: fix build with python 3.13
Peter Marko (1):
builder: set CVE_PRODUCT
Ross Burton (1):
gstreamer1.0: improve test reliability
meta/classes/package_rpm.bbclass | 3 +-
...0001-split-do-not-shrink-hold-buffer.patch | 42 ++
meta/recipes-core/coreutils/coreutils_9.0.bb | 1 +
.../glib-2.0/gdatetime-test-fail-0001.patch | 72 ++++
.../glib-2.0/gdatetime-test-fail-0002.patch | 65 +++
.../glib-2.0/gdatetime-test-fail-0003.patch | 63 +++
meta/recipes-core/glib-2.0/glib-2.0_2.72.3.bb | 3 +
...4efb41c039789b81f0dc0d67c1ed0faea17c.patch | 62 +++
meta/recipes-devtools/ninja/ninja_1.10.2.bb | 5 +-
.../python/python3-pip/CVE-2023-5752.patch | 34 ++
.../python/python3-pip_22.0.3.bb | 8 +-
meta/recipes-extended/timezone/timezone.inc | 6 +-
meta/recipes-graphics/builder/builder_0.1.bb | 4 +-
.../ffmpeg/ffmpeg/CVE-2023-47342.patch | 39 ++
.../ffmpeg/ffmpeg/CVE-2023-50007.patch | 78 ++++
.../ffmpeg/ffmpeg/CVE-2023-51796.patch | 39 ++
.../ffmpeg/ffmpeg/CVE-2023-51798.patch | 45 ++
.../ffmpeg/ffmpeg/CVE-2024-7055.patch | 38 ++
.../recipes-multimedia/ffmpeg/ffmpeg_5.0.1.bb | 5 +
.../gstreamer/gstreamer1.0/run-ptest | 16 +-
.../libsndfile1/CVE-2024-50612.patch | 402 ++++++++++++++++++
.../libsndfile/libsndfile1_1.0.31.bb | 1 +
22 files changed, 1020 insertions(+), 11 deletions(-)
create mode 100644 meta/recipes-core/coreutils/coreutils/0001-split-do-not-shrink-hold-buffer.patch
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/gdatetime-test-fail-0001.patch
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/gdatetime-test-fail-0002.patch
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/gdatetime-test-fail-0003.patch
create mode 100644 meta/recipes-devtools/ninja/ninja/885b4efb41c039789b81f0dc0d67c1ed0faea17c.patch
create mode 100644 meta/recipes-devtools/python/python3-pip/CVE-2023-5752.patch
create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2023-47342.patch
create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2023-50007.patch
create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2023-51796.patch
create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2023-51798.patch
create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-7055.patch
create mode 100644 meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2024-50612.patch
--
2.34.1
^ permalink raw reply [flat|nested] 20+ messages in thread
* [OE-core][kirkstone 00/14] Patch review
@ 2025-04-30 2:53 Steve Sakoman
0 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-04-30 2:53 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Thursday, May 1
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1494
The following changes since commit f23d1bfca0ea57150c397bc2e495191fb61423d0:
ruby: fix CVE-2024-43398 (2025-04-15 06:43:55 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Chen Qi (1):
systemd: backport patch to fix journal issue
Deepesh Varatharajan (1):
binutils: Fix CVE-2025-1178
Haitao Liu (1):
systemd: systemd-journald fails to setup LogNamespace
Peter Marko (8):
sqlite3: patch CVE-2025-29088
ppp: patch CVE-2024-58250
ghostscript: ignore CVE-2025-27833
libarchive: ignore CVE-2024-48615
libxml2: patch CVE-2025-32414
libxml2: patch CVE-2025-32415
glib-2.0: patch CVE-2025-3360
Revert "cve-update-nvd2-native: Tweak to work better with NFS DL_DIR"
Priyal Doshi (1):
tzdata/tzcode-native: upgrade 2025a -> 2025b
Shubham Kulkarni (1):
libpam: Update fix for CVE-2024-10041
Soumya Sambu (1):
python3-setuptools: Fix CVE-2024-6345
.../ppp/ppp/CVE-2024-58250.patch | 185 +++++++++
meta/recipes-connectivity/ppp/ppp_2.4.9.bb | 2 +-
.../glib-2.0/glib-2.0/CVE-2025-3360-01.patch | 57 +++
.../glib-2.0/glib-2.0/CVE-2025-3360-02.patch | 53 +++
.../glib-2.0/glib-2.0/CVE-2025-3360-03.patch | 36 ++
.../glib-2.0/glib-2.0/CVE-2025-3360-04.patch | 76 ++++
.../glib-2.0/glib-2.0/CVE-2025-3360-05.patch | 57 +++
.../glib-2.0/glib-2.0/CVE-2025-3360-06.patch | 50 +++
meta/recipes-core/glib-2.0/glib-2.0_2.72.3.bb | 6 +
.../libxml/libxml2/CVE-2025-32414.patch | 74 ++++
.../libxml/libxml2/CVE-2025-32415.patch | 39 ++
meta/recipes-core/libxml/libxml2_2.9.14.bb | 2 +
.../meta/cve-update-nvd2-native.bb | 2 -
...n-in-mkdir_p-when-parent-directory-e.patch | 78 ++++
...journal_previous-next-return-0-at-HE.patch | 87 +++++
meta/recipes-core/systemd/systemd_250.14.bb | 2 +
.../binutils/binutils-2.38.inc | 1 +
.../binutils/0039-CVE-2025-1178.patch | 33 ++
.../python3-setuptools/CVE-2024-6345.patch | 353 ++++++++++++++++++
.../python/python3-setuptools_59.5.0.bb | 1 +
.../ghostscript/ghostscript_9.55.0.bb | 3 +-
.../libarchive/libarchive_3.6.2.bb | 2 +
...024-10041.patch => CVE-2024-10041-1.patch} | 0
.../pam/libpam/CVE-2024-10041-2.patch | 77 ++++
meta/recipes-extended/pam/libpam_1.5.2.bb | 3 +-
meta/recipes-extended/timezone/timezone.inc | 6 +-
.../sqlite/files/CVE-2025-29088.patch | 179 +++++++++
meta/recipes-support/sqlite/sqlite3_3.38.5.bb | 1 +
28 files changed, 1457 insertions(+), 8 deletions(-)
create mode 100644 meta/recipes-connectivity/ppp/ppp/CVE-2024-58250.patch
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2025-3360-01.patch
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2025-3360-02.patch
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2025-3360-03.patch
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2025-3360-04.patch
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2025-3360-05.patch
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2025-3360-06.patch
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2025-32414.patch
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2025-32415.patch
create mode 100644 meta/recipes-core/systemd/systemd/0001-basic-do-not-warn-in-mkdir_p-when-parent-directory-e.patch
create mode 100644 meta/recipes-core/systemd/systemd/0001-journal-Make-sd_journal_previous-next-return-0-at-HE.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/0039-CVE-2025-1178.patch
create mode 100644 meta/recipes-devtools/python/python3-setuptools/CVE-2024-6345.patch
rename meta/recipes-extended/pam/libpam/{CVE-2024-10041.patch => CVE-2024-10041-1.patch} (100%)
create mode 100644 meta/recipes-extended/pam/libpam/CVE-2024-10041-2.patch
create mode 100644 meta/recipes-support/sqlite/files/CVE-2025-29088.patch
--
2.43.0
^ permalink raw reply [flat|nested] 20+ messages in thread
* [OE-core][kirkstone 00/14] Patch review
@ 2025-06-22 14:59 Steve Sakoman
0 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-06-22 14:59 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Tuesday, June 24
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1857
The following changes since commit e0857503de9f427d177fe85c32cf0d2748d779fb:
glibc: nptl Use all of g1_start and g_signals (2025-06-17 08:05:29 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Ashish Sharma (1):
libsoup: patch CVE-2025-4476
Changqing Li (8):
libsoup: fix CVE-2025-32907
libsoup: fix CVE-2025-32051
libsoup: fix CVE-2025-46421
libsoup: fix CVE-2025-4948
libsoup-2.4: fix CVE-2025-32907
libsoup-2.4: fix CVE-2025-46421
libsoup-2.4: fix CVE-2025-4948
libsoup-2.4: fix CVE-2025-4476
Hitendra Prajapati (2):
libsoup: Fix CVE-2025-4969
libsoup-2.4: Fix CVE-2025-4969
Moritz Haase (1):
cmake: Correctly handle cost data of tests with arbitrary chars in
name
Peter Marko (1):
go: ignore CVE-2024-3566
Soumya Sambu (1):
systemtap: add sysroot Python paths to configure flags
.../cmake/cmake-native_3.22.3.bb | 2 +-
...trary-characters-in-test-names-of-CT.patch | 205 ++++++++++++++++++
meta/recipes-devtools/cmake/cmake_3.22.3.bb | 1 +
.../go/go-binary-native_1.17.13.bb | 3 +
meta/recipes-devtools/go/go-common.inc | 3 +
.../recipes-kernel/systemtap/systemtap_git.bb | 7 +
.../libsoup/libsoup-2.4/CVE-2025-32907.patch | 39 ++++
.../libsoup/libsoup-2.4/CVE-2025-4476.patch | 38 ++++
.../libsoup/libsoup-2.4/CVE-2025-46421.patch | 47 ++++
.../libsoup/libsoup-2.4/CVE-2025-4948.patch | 38 ++++
.../libsoup/libsoup-2.4/CVE-2025-4969.patch | 76 +++++++
.../libsoup/libsoup-2.4_2.74.2.bb | 5 +
.../libsoup/libsoup/CVE-2025-32051-1.patch | 29 +++
.../libsoup/libsoup/CVE-2025-32051-2.patch | 57 +++++
.../libsoup/libsoup/CVE-2025-32907-1.patch | 200 +++++++++++++++++
.../libsoup/libsoup/CVE-2025-32907-2.patch | 68 ++++++
.../libsoup/libsoup/CVE-2025-4476.patch | 38 ++++
.../libsoup/libsoup/CVE-2025-46421.patch | 139 ++++++++++++
.../libsoup/libsoup/CVE-2025-4948.patch | 97 +++++++++
.../libsoup/libsoup/CVE-2025-4969.patch | 76 +++++++
meta/recipes-support/libsoup/libsoup_3.0.7.bb | 8 +
21 files changed, 1175 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-devtools/cmake/cmake/0001-ctest-Allow-arbitrary-characters-in-test-names-of-CT.patch
create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2025-32907.patch
create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2025-4476.patch
create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2025-46421.patch
create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2025-4948.patch
create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2025-4969.patch
create mode 100644 meta/recipes-support/libsoup/libsoup/CVE-2025-32051-1.patch
create mode 100644 meta/recipes-support/libsoup/libsoup/CVE-2025-32051-2.patch
create mode 100644 meta/recipes-support/libsoup/libsoup/CVE-2025-32907-1.patch
create mode 100644 meta/recipes-support/libsoup/libsoup/CVE-2025-32907-2.patch
create mode 100644 meta/recipes-support/libsoup/libsoup/CVE-2025-4476.patch
create mode 100644 meta/recipes-support/libsoup/libsoup/CVE-2025-46421.patch
create mode 100644 meta/recipes-support/libsoup/libsoup/CVE-2025-4948.patch
create mode 100644 meta/recipes-support/libsoup/libsoup/CVE-2025-4969.patch
--
2.43.0
^ permalink raw reply [flat|nested] 20+ messages in thread
* [OE-core][kirkstone 00/14] Patch review
@ 2025-10-14 22:44 Steve Sakoman
0 siblings, 0 replies; 20+ messages in thread
From: Steve Sakoman @ 2025-10-14 22:44 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Thursday, October 16
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/2585
The following changes since commit 0d11c9103f072841baf39166efc133f2a20fc4dc:
oeqa/sdk/cases/buildcpio.py: use gnu mirror instead of main server (2025-10-09 07:35:42 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Peter Marko (3):
qemu: patch CVE-2024-8354
binutils: patch CVE-2025-11082
binutils: patch CVE-2025-11083
Sunil Dora (11):
glibc: Remove partial BZ#25847 backport patches
glibc: pthreads NPTL lost wakeup fix 2
glibc: nptl Update comments and indentation for new condvar
implementation
glibc: nptl Remove unnecessary catch-all-wake in condvar group switch
glibc: nptl Remove unnecessary quadruple check in pthread_cond_wait
glibc: Remove g_refs from condition variables
glibc: nptl Use a single loop in pthread_cond_wait instaed of a nested
loop
glibc: nptl Fix indentation
glibc: nptl rename __condvar_quiesce_and_switch_g1
glibc: nptl Use all of g1_start and g_signals
glibc: : PTHREAD_COND_INITIALIZER compatibility with pre-2.41 versions
(bug 32786)
.../glibc/glibc/0026-PR25847-1.patch | 24 +-
.../glibc/glibc/0026-PR25847-10.patch | 54 ++++
.../glibc/glibc/0026-PR25847-2.patch | 13 +-
.../glibc/glibc/0026-PR25847-3.patch | 18 +-
.../glibc/glibc/0026-PR25847-4.patch | 11 +-
.../glibc/glibc/0026-PR25847-5.patch | 237 ++++++++++-----
.../glibc/glibc/0026-PR25847-6.patch | 220 +++++---------
.../glibc/glibc/0026-PR25847-7.patch | 277 +++++++++---------
.../glibc/glibc/0026-PR25847-8.patch | 269 ++++++++---------
.../glibc/glibc/0026-PR25847-9.patch | 193 ++++++++++++
meta/recipes-core/glibc/glibc_2.35.bb | 2 +
.../binutils/binutils-2.38.inc | 2 +
.../binutils/0044-CVE-2025-11082.patch | 46 +++
.../binutils/0045-CVE-2025-11083.patch | 77 +++++
meta/recipes-devtools/qemu/qemu.inc | 1 +
.../qemu/qemu/CVE-2024-8354.patch | 75 +++++
16 files changed, 974 insertions(+), 545 deletions(-)
create mode 100644 meta/recipes-core/glibc/glibc/0026-PR25847-10.patch
create mode 100644 meta/recipes-core/glibc/glibc/0026-PR25847-9.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/0044-CVE-2025-11082.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/0045-CVE-2025-11083.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2024-8354.patch
--
2.43.0
^ permalink raw reply [flat|nested] 20+ messages in thread
end of thread, other threads:[~2025-10-14 22:45 UTC | newest]
Thread overview: 20+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-03-23 21:04 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 01/14] curl: Add fix for CVE-2023-23914, CVE-2023-23915 Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 02/14] systemd: fix CVE-2022-4415 Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 03/14] git: ignore CVE-2023-22743 Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 04/14] devtool/upgrade: do not delete the workspace/recipes directory Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 05/14] systemd.bbclass: Add /usr/lib/systemd to searchpaths as well Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 06/14] image_types: fix multiubi var init Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 07/14] oeqa rtc.py: skip if read-only-rootfs Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 08/14] lib/resulttool: fix typo breaking resulttool log --ptest Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 09/14] timezone: use 'tz' subdir instead of ${WORKDIR} directly Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 10/14] tzdata: use separate B instead of WORKDIR for zic output Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 11/14] tzcode-native: fix build with gcc-13 on host Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 12/14] pybootchartui: Fix python syntax issue Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 13/14] cracklib: update github branch to 'main' Steve Sakoman
2023-03-23 21:04 ` [OE-core][kirkstone 14/14] systemd: fix wrong nobody-group assignment Steve Sakoman
-- strict thread matches above, loose matches on Subject: below --
2023-09-06 12:48 [OE-core][kirkstone 00/14] Patch review Steve Sakoman
2024-11-27 18:49 Steve Sakoman
2025-04-30 2:53 Steve Sakoman
2025-06-22 14:59 Steve Sakoman
2025-10-14 22:44 Steve Sakoman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox